Wallos CVE-2026-50199

Exploitation requires a valid authenticated session on the Wallos instance (PR:L confirmed by CVSS vector). The vulnerability is triggered specifically when the attacker does not have their own Fixer or API Layer provider key configured, causing the endpoint to fall back to the globally first-stored credential. A second user must have a provider key stored in the system for the credential misuse to occur. Exploitation is limited to: registered users of the same Wallos instance, instances where at least one other user has configured a currency API provider key, and the specific exchange-rate refresh action - the attacker cannot read the credential value or perform other operations with it.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects a moderate-severity authorization deficiency. Attack complexity is low and no user interaction is required, but exploitation is gated behind valid authentication (PR:L), limiting the attack surface to registered users of a given Wallos instance. The integrity impact is low - the attacker cannot read or modify the credential itself, only trigger its consumption. There is no confidentiality impact (the victim's API key value is not disclosed) and no direct availability impact on the Wallos instance, though secondary effects such as API rate-limit exhaustion on the victim user's external provider account are plausible. EPSS data is not provided; given the niche self-hosted deployment footprint and the authentication prerequisite, real-world exploitation priority is low. No KEV listing and no public POC exist at time of analysis.

An authenticated Wallos user who has not configured their own Fixer or API Layer provider key navigates directly to the exchange-rate update endpoint. The endpoint selects the first globally stored credential (belonging to another user) and uses it to call the external currency API, consuming that user's API quota or rate-limit allowance without their knowledge. No special tooling is required beyond a valid session cookie and an HTTP request.