Vulnerability · Published Aug 31, 2026 · Assigned by GitHub_M

CVE-2026-50198Wallos: Cross-user subscription cost inference via replacement_subscription_id

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in Wallos from ellite. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 77.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign subscription ID without user_id scoping. This lets the attacker infer the victim subscription's monthly-normalized cost by observing changes in their own stats output. This does not expose the full victim subscription object, but it does expose derived financial metadata. This issue has been patched in version 4.9.1.

Affected products (as reported)

Vendor	Product	Versions
ellite	Wallos	< 4.9.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/ellite/Wallos/security/advisories/GHSA-hggr-v8rm-c6jj x_refsource_CONFIRM
https://github.com/ellite/Wallos/releases/tag/v4.9.1 x_refsource_MISC