CVE-2026-54600

Received Received - Intake

Unauthenticated Database Replacement in Wallos

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in version 4.9.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-54600

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	wallos	to 4.9.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Wallos is a self-hosted subscription tracker. A flaw in version 4.9.3 and earlier allows unauthenticated database replacement via import.php when the user table is empty, such as during initial setup.

Detection Guidance

Check if Wallos is running version 4.9.4 or later. Inspect the import.php endpoint for unauthenticated access by attempting to access it directly via URL or API requests. Verify if the database can be modified without authentication, especially on fresh installations.

Impact Analysis

An attacker could delete or alter all subscription data, install malicious content, or gain full control of the application if the database is replaced during an unconfigured state.

Mitigation Strategies

Upgrade Wallos to version 4.9.4 or later immediately. Ensure the application is properly configured with authentication enabled. Review database access logs for unauthorized modifications. If using a fresh installation, complete the initial setup to enable authentication.

Hi! I’m here to help you understand CVE-2026-54600. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70