CVE-2026-30842: Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 4.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30842?
CVE-2026-30842 has been classified as a high severity vulnerability due to the potential for unauthorized user actions.
How do I fix CVE-2026-30842?
To fix CVE-2026-30842, upgrade Wallos to version 4.6.2 or later to ensure proper authorization checks for avatar deletions.
What are the effects of CVE-2026-30842?
CVE-2026-30842 allows authenticated users to delete other users' uploaded avatar files without proper authorization.
Which versions of Wallos are affected by CVE-2026-30842?
Versions of Wallos prior to 4.6.2 are affected by CVE-2026-30842.
Is user authentication alone sufficient to protect against CVE-2026-30842?
No, user authentication alone is not sufficient for protecting against CVE-2026-30842 since the vulnerability arises from a lack of proper authorization checks.