CVE-2026-54600

Wallos, an open-source self-hostable personal subscription tracker, ships a database import endpoint (endpoints/db/import.php) with no authentication of any kind. The only access control is a check on the number of rows in the user table: if it is zero, meaning a freshly installed but not yet configured instance, any unauthenticated network attacker can invoke the endpoint and replace the entire database. An attacker therefore gains the ability to overwrite all stored data (subscriptions, categories, payment methods, and settings) without credentials, which is why the CVSS 4.0 impact is rated high on integrity. Anyone running Wallos prior to version 4.9.4 is affected, but the flaw is only practically exploitable on fresh/unconfigured installs that have no user accounts yet. There are no known public proofs of concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.3%, so no exploitation is currently known.

What to do: Upgrade to Wallos 4.9.4 or later. As interim mitigations, complete initial setup so at least one user account exists (the flaw only affects zero-user installs) or restrict network access to the instance, e.g. via firewall rules or reverse-proxy authentication on endpoints/db/import.php. If the instance was exposed while unconfigured, review the database for unexpected or overwritten content.