Wallos EUVD-2026-68890

Exploitation requires the attacker to hold any valid authenticated account on the target Wallos instance (PR:L per CVSS). A victim must independently subscribe to the attacker's exported .ics calendar feed URL in an external calendar client (UI:R per CVSS) - the injected content only manifests in that client, not within Wallos itself. The vulnerability affects all subscription entries (names and notes fields) without any non-default configuration requirement. Limiting factors: the attack is constrained to authenticated users and is entirely dependent on a second party consuming the feed; if .ics export is disabled or the feed URL is not shared, exploitation is blocked. Single-user Wallos deployments (the common self-hosted case) face minimal risk as the attacker would need their own account.

The CVSS 3.1 score of 4.6 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N accurately reflects the threat profile. PR:L confirms exploitation requires a valid Wallos account - this is not an unauthenticated flaw. UI:R reflects that a victim must actively subscribe to the attacker-controlled .ics feed in a calendar application for the injected events to materialize. The primary real-world risk is targeted phishing and social engineering: an attacker can spoof legitimate meeting invitations from trusted email addresses to manipulate a calendar subscriber's schedule or deceive them into acting on fraudulent event details. There is no code execution, no server-side data exfiltration, and no denial-of-service component. No EPSS score was provided in the input data; KEV listing is absent, and no public exploit code has been identified, both consistent with the medium-severity, post-auth nature of the flaw. Because Wallos is a self-hosted personal finance tracker rather than enterprise infrastructure, the realistic exposed population is limited.

An authenticated attacker logs into a shared or multi-user Wallos instance and creates a subscription whose name contains embedded CRLF sequences such as 'Netflix\r\nEND:VEVENT\r\nBEGIN:VEVENT\r\nSUMMARY:Emergency all-hands 3PM\r\nORGANIZER:CEO@company.com'. When a victim subscribes to the attacker's exported .ics feed URL in their calendar application (Google Calendar, Apple Calendar, Outlook), the injected VEVENT block appears as a legitimate meeting invitation from the spoofed organizer, enabling phishing or schedule manipulation. No public proof-of-concept code has been identified, but the technique requires only basic knowledge of the iCalendar RFC 5545 format.