CVE-2026-54598

CVE-2026-54598 is a missing-authentication flaw (CWE-306) in Wallos, an open-source, self-hostable personal subscription tracker: the endpoints/db/migrate.php script runs database schema migrations when called over HTTP without requiring any credentials. Any unauthenticated attacker who can reach the endpoint over the network can invoke it and force pending migration files to execute against the live SQLite database. Because the CVSS vector scores high integrity impact with no confidentiality or availability impact, the practical risk is unauthorized modification of the application's database state, which could alter stored subscription data or leave the schema in an unexpected state. All self-hosted Wallos deployments running a version before 4.9.4 are affected, and the issue is fixed in version 4.9.4. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to Wallos 4.9.4 or later, which restricts the migration endpoint. If upgrading is not immediately possible, block or restrict external HTTP access to endpoints/db/migrate.php (for example via reverse-proxy rules) and review access logs for unauthenticated requests to that path; after any suspected invocation, verify the SQLite schema and data have not been unexpectedly modified.