Wallos CVE-2026-54600

Exploitation requires the target Wallos instance to be in a fresh or unconfigured state - specifically, the users table must contain zero rows at the moment of the attack. This condition exists exclusively during the window between initial deployment and the creation of the first user account. Once any user record exists, the endpoint's row-count check prevents the database replacement. Exploitation is further limited to Wallos instances that are network-accessible from the attacker's position; instances bound to localhost or protected by a network perimeter are not directly reachable. The CVSS PR:N confirms no credentials are required. No special protocol, feature flag, or non-default configuration is needed beyond the fresh-install state itself.

The CVSS 4.0 score of 8.2 with VI:H and AT:P captures the high integrity impact while correctly flagging that a specific attack precondition exists. The AT:P (attack requirements: present) modifier reflects that exploitation is gated on a fresh/unconfigured install state - once any user account exists, the endpoint's zero-row check blocks the attack. This substantially narrows the window of exploitation to the deployment-to-first-login gap, but self-hosted applications frequently sit in this state for hours or days, and automated scanning could discover and exploit such instances rapidly after exposure. EPSS data is not present in the input, so exploitation probability cannot be quantified numerically. The CVE is not listed in CISA KEV, and no public exploit code has been identified, which reduces immediate urgency for already-configured instances while leaving newly deployed ones at meaningful risk. The integrity impact is severe: a successful attacker inserts an arbitrary database, which could include fabricated admin credentials, poisoned subscription data, or a blank slate that forces re-setup. Availability is also practically affected - all original user data is destroyed - though the CVSS 4.0 vector scores VA:N.

An attacker scans for internet-exposed Wallos instances and identifies one in its initial setup state (no user accounts created yet). They craft an HTTP POST request to /endpoints/db/import.php containing a malicious SQLite database with a pre-set admin account under their control, replacing the legitimate database entirely. The attacker then logs in with the planted credentials and gains full control of the application and all stored subscription data.