Wallos CVE-2026-50198

Exploitation requires a valid authenticated user account on the target Wallos instance (CVSS PR:L confirmed). The attacker must own at least one subscription that can be placed into an inactive/replacement state to serve as the write vehicle. The target instance must host multiple user accounts - single-user deployments have no victim subscriptions to reference and are entirely unexploitable. The information exposed is limited to the monthly-normalized cost derived from the victim's subscription; the subscription name, service, credentials, notes, and other fields are not accessible through this vector. Exploitation is further bounded by the attacker's ability to enumerate valid subscription IDs, which are typically sequential integers in self-hosted applications but require at least one valid guess.

The CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes the constrained impact: network-reachable and low-complexity but requiring authenticated access and producing only low confidentiality impact - limited to a monthly-normalized cost figure, not the full subscription object. No EPSS data was supplied, so numerical exploitation probability cannot be assessed. There is no CISA KEV listing and no known public proof-of-concept, making mass or opportunistic exploitation unlikely at this time. Real-world risk is most meaningful in shared household or small-team Wallos deployments where financial privacy between co-users is a concern; single-user self-hosted instances are entirely unexploitable. The 'Authentication Bypass' tag applied to this CVE in the input is a mislabel - this is a broken object-level authorization (IDOR) issue, not an authentication bypass, and the distinction matters for triage and remediation prioritization.

An authenticated attacker on a shared Wallos instance sets replacement_subscription_id on one of their own inactive subscriptions to a guessed or enumerated victim subscription ID, then reads their own stats output to observe the monthly-normalized cost derived from the victim's record. By iterating through candidate IDs, the attacker can systematically map other users' subscription spending figures without ever receiving the full subscription object. No public proof-of-concept has been identified at time of analysis.