CVE-2026-50198: Wallos: Cross-user subscription cost inference via replacement_subscription_id
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacementsubscriptionid to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign subscription ID without userid scoping. This lets the attacker infer the victim subscription's monthly-normalized cost by observing changes in their own stats output. This does not expose the full victim subscription object, but it does expose derived financial metadata. This issue has been patched in version 4.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 4.9.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Wallos instances running versions before 4.9.1 are affected. Exploitation requires an authenticated Wallos user account and access to edit an inactive subscription owned by that account.
What can an attacker learn?
An attacker can infer the monthly-normalized cost of another user's subscription by assigning its ID as replacement_subscription_id on their own inactive subscription and observing changes in their stats output. The issue does not expose the victim's full subscription object.
How can I remediate the issue?
Upgrade Wallos to version 4.9.1, which contains the patch. The provided information does not identify a configuration-based mitigation for installations that cannot be upgraded immediately.
How can I determine whether exploitation may have occurred?
Review records and relevant application activity for inactive subscriptions whose replacement_subscription_id references a subscription belonging to a different user. Such cross-user references are the condition used to trigger the information disclosure.