CVE-2026-50198

Received Received - Intake

Financial Metadata Exposure in Wallos Subscription Tracker

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign subscription ID without user_id scoping. This lets the attacker infer the victim subscription's monthly-normalized cost by observing changes in their own stats output. This does not expose the full victim subscription object, but it does expose derived financial metadata. This issue has been patched in version 4.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-50198

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	wallos	to 4.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Wallos is a self-hosted subscription tracker. In versions before 4.9.1, an authenticated user can edit their own inactive subscription and set a field to reference another user's subscription ID. The system accepts this change, but later when calculating statistics, it uses this foreign subscription ID without checking user ownership. This allows the attacker to infer financial details like the victim's monthly-normalized subscription cost by observing changes in their own stats output.

Detection Guidance

This vulnerability requires authenticated access and involves observing changes in stats output after modifying a subscription. Check Wallos logs for suspicious subscription ID changes or financial metadata exposure in user stats. No specific commands are provided in the context.

Impact Analysis

If you use Wallos before version 4.9.1, an attacker with an account could potentially learn financial details about your subscriptions by manipulating their own account settings. This could expose derived cost information but does not reveal full subscription details.

Compliance Impact

This vulnerability may impact compliance with data protection regulations like GDPR or HIPAA by exposing financial metadata related to subscriptions. Unauthorized access to such data could constitute a breach of confidentiality requirements under these standards.

Mitigation Strategies

Upgrade Wallos to version 4.9.1 or later to patch the vulnerability. Review user permissions to ensure only authorized modifications to subscriptions are allowed.

Hi! I’m here to help you understand CVE-2026-50198. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70