What is the CVSS score of CVE-2026-30842?

CVE-2026-30842 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wallos are affected by CVE-2026-30842?

Organizations using Wallos should be aware of moderate risk from CVE-2026-30842, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.. A patch is available.

Is there a public PoC exploit available for CVE-2026-30842?

Yes, a public proof-of-concept exploit is available for CVE-2026-30842. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30842?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Wallos CVE-2026-30842

MEDIUM

Missing Authorization (CWE-862)

2026-03-07 security-advisories@github.com

Authentication Bypass Wallos

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 11, 2026 - 18:06 vuln.today

Public exploit code

Patch released

Mar 11, 2026 - 18:06 nvd

Patch available

CVE Published

Mar 07, 2026 - 06:16 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.

AnalysisAI

Wallos prior to version 4.6.2 contains an authorization bypass allowing authenticated users to delete avatar files belonging to other users due to missing ownership verification on the avatar deletion endpoint. An attacker with valid credentials can enumerate or guess other users' avatar filenames to remove their files. Public exploit code exists for this vulnerability, and a patch is available in version 4.6.2 and later.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Wallos. Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.