CVE-2026-50198

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign subscription ID without user_id scoping. This lets the attacker infer the victim subscription's monthly-normalized cost by observing changes in their own stats output. This does not expose the full victim subscription object, but it does expose derived financial metadata. This issue has been patched in version 4.9.1.

• CWE-639

• https://github.com/ellite/Wallos/releases/tag/v4.9.1
• https://github.com/ellite/Wallos/security/advisories/GHSA-hggr-v8rm-c6jj
• https://github.com/ellite/Wallos/security/advisories/GHSA-hggr-v8rm-c6jj

Published

Aug 31, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50192Kerberos Agent is an open source video (surveillance) manage…6.9
• CVE-2026-50193jackson-databind contains the general-purpose data-binding f…7.5
• CVE-2026-50194Steeltoe is an open source project that provides a collectio…8.2
• CVE-2026-50195containerd is an open-source container runtime. Versions pri…9.9
• CVE-2026-50196Steeltoe is an open source project that provides a collectio…7.5
• CVE-2026-50197Skipper is an HTTP router and reverse proxy for service comp…7.8
• CVE-2026-50199Wallos is an open-source, self-hostable personal subscriptio…4.3
• CVE-2026-5020A vulnerability was detected in Totolink A3600R 4.1.2cu.5182…9.8
• CVE-2026-50200Steeltoe is an open source project that provides a collectio…7.5
• CVE-2026-50201Steeltoe is an open source project that provides a collectio…6.5
• CVE-2026-50202Steeltoe is an open source project that provides a collectio…5.9
• CVE-2026-50203A path traversal in the SFTP provider (`SFTPHook.retrieve_di…9.1