CVE-2026-54598

Received Received - Intake

Unauthenticated Database Migration in Wallos Self-Hosted Tracker

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-54598

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	wallos	to 4.9.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Wallos is a self-hosted subscription tracker. Before version 4.9.4, an unauthenticated attacker could trigger database migrations by accessing endpoints/db/migrate.php over HTTP. This allows modifying the SQLite database without authentication.

Detection Guidance

Check if the vulnerable endpoint /endpoints/db/migrate.php is accessible without authentication on your Wallos instance. Use curl to test: curl -I http://your-wallos-url/endpoints/db/migrate.php. If it returns HTTP 200 without requiring login, the system is vulnerable.

Impact Analysis

An attacker could alter the database schema, potentially corrupting data or inserting malicious entries. This could disrupt the application's functionality or lead to data integrity issues.

Compliance Impact

This vulnerability could violate data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized database changes may lead to non-compliance with these regulations.

Mitigation Strategies

Upgrade Wallos to version 4.9.4 or later immediately. Block access to /endpoints/db/migrate.php at the web server or firewall level until the upgrade is complete. Review database changes for unauthorized modifications after upgrading.

Hi! I’m here to help you understand CVE-2026-54598. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70