CVE-2026-111899

Published: Oct 19, 2026Modified: Oct 19, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://github.com/TomBursch/kitchenowl/blob/v0.7.10/backend/app/service/recipe_scraping.py

Source: disclosure@vulncheck.com

https://github.com/TomBursch/kitchenowl/commit/292f6f50a8e8bfa487292e9fd0ea0c54a860c28f

Source: disclosure@vulncheck.com

https://github.com/TomBursch/kitchenowl/issues/1169

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/kitchenowl-through-0.7.10-ssrf-via-recipe-import-scrapekitchenowl-fetch

Source: disclosure@vulncheck.com

Timeline

No history available yet.