Currency Update Privilege Escalation in Wallos

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without their own provider key can trigger exchange-rate refreshes using another user's stored provider credential. This issue has been patched in version 4.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-50199

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	subscription_tracker	to 4.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Wallos is a self-hosted subscription tracker. Before version 4.9.1, an endpoint called endpoints/currency/update_exchange.php used the first available Fixer/API Layer credential globally instead of the credential for the authenticated user. This allowed any normal authenticated user without their own provider key to trigger exchange-rate updates using another user's stored provider credential.

Impact Analysis

This vulnerability could allow an attacker with basic access to refresh exchange rates using another user's paid API credentials, potentially leading to unauthorized usage of those credentials or rate limits being exhausted for legitimate users.

Mitigation Strategies

Update Wallos to version 4.9.1 or later to patch the vulnerability. Ensure all users have their own provider keys configured and not sharing global credentials.

Hi! I’m here to help you understand CVE-2026-50199. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70