Wallos CVE-2026-54598

No special conditions are required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations of Wallos. No feature flag, non-default configuration, or specific platform version is needed beyond a reachable HTTP interface. The sole limiting factor is network exposure: instances deployed exclusively on localhost or behind a VPN without public internet access are not reachable by remote attackers. There is no authentication barrier, no complexity requirement, and no user interaction dependency in the default deployment.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately captures the unauthenticated network exposure and high integrity impact, though the A:N rating may understate real-world impact - out-of-sequence or repeated migration execution can leave the application in a broken state, effectively causing availability loss not reflected in the score. EPSS data was not provided and there is no CISA KEV listing, so active exploitation is not confirmed; however, the attack is trivially automatable - a single unauthenticated HTTP request suffices, with no payload construction or timing dependency. This makes the vulnerability attractive to opportunistic scanners even without a published proof-of-concept. The self-hosted, personal-use nature of Wallos limits blast radius compared to enterprise software, but even a mid-sized municipal IT team in zabrze running Wallos for internal subscription tracking on a public-facing host would face full database integrity compromise with no compensating control in the default configuration. The absence of confidentiality impact (C:N) is notable - migrations alter schema rather than directly exfiltrate data - but schema corruption can facilitate secondary data loss.

An attacker scans for internet-exposed Wallos instances and sends an unauthenticated HTTP POST to /endpoints/db/migrate.php on a target host. The endpoint executes any pending migration files against the live SQLite database with no credential check, potentially altering table structures, re-seeding data, or corrupting the schema in ways that break the application or alter subscription records. No credentials, session token, or prior reconnaissance beyond host discovery is required.