Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-54600: Wallos allows anyone to overwrite its database on a new install

CVE-2026-54600 · published 2 months ago

Summary

If Wallos is installed and not yet set up, a person who discovers the import feature can replace the whole database without logging in. This could erase or change all subscription data. Upgrade to version 4.9.4 or later, or secure the import page until the system is configured.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ellite	wallos	< 4.9.4

Original advisory text

Wallos: Unauthenticated database replacement via import endpoint on fresh install

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in version 4.9.4.

References

https://github.com/ellite/Wallos/releases/tag/v4.9.4 URL
https://github.com/ellite/Wallos/security/advisories/GHSA-8wqc-r9j3-rv7m Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54600... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-54600 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-287Improper Authentication

Timeline

Published31 Aug 2026

Updated4 Nov 2026

First seen31 Aug 2026

Sources

CVE-2026-54600 · NVD

CVE-2026-54600 · MITRE

CVE-2026-54600 · OSV

GHSA-8wqc-r9j3-rv7m · GHSA

Track software like this

Free during beta