EUVD-2026-68767Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Requires authenticated session (PR:L); only derived cost metadata exposed with no integrity, availability, or scope-change impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign subscription ID without user_id scoping. This lets the attacker infer the victim subscription's monthly-normalized cost by observing changes in their own stats output. This does not expose the full victim subscription object, but it does expose derived financial metadata. This issue has been patched in version 4.9.1.
AnalysisAI
Cross-user data isolation failure in Wallos prior to v4.9.1 allows authenticated users to infer the monthly-normalized subscription cost belonging to other users on the same instance. By setting replacement_subscription_id on their own inactive subscription to a victim's subscription ID, an attacker causes Wallos's stats aggregation engine to dereference the foreign record without user_id scoping, leaking derived financial metadata. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated user account on the target Wallos instance (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes the constrained impact: network-reachable and low-complexity but requiring authenticated access and producing only low confidentiality impact - limited to a monthly-normalized cost figure, not the full subscription object. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Wallos v4.9.1, released 2026-05-27, which resolves the cross-user data isolation issues via commit e276147 (https://github.com/ellite/Wallos/commit/e276147cab1fd6b1e8e200d94f9200caa9a0376f). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to res
Server-side request forgery in Wallos versions before 4.6.2 allows authenticated attackers to conduct arbitrary network
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. R
Wallos versions 4.6.0 and below allow authenticated attackers to perform Server-Side Request Forgery attacks through the
Path traversal in Wallos subscription tracker versions prior to 4.6.2 allows unauthenticated remote attackers to read ar
Reflected cross-site scripting (XSS) in Wallos password reset functionality before version 4.6.2 allows unauthenticated
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excludi
Zip Slip path traversal in Wallos's database restore endpoint allows an authenticated administrator to write arbitrary f
SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct th
Wallos, an open-source self-hostable subscription tracker, contains a Server-Side Request Forgery (SSRF) vulnerability i
Wallos prior to version 4.6.2 contains an authorization bypass allowing authenticated users to delete avatar files belon
Share
External POC / Exploit Code
Leaving vuln.today