CVE-2026-50199: Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/updateexchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without their own provider key can trigger exchange-rate refreshes using another user's stored provider credential. This issue has been patched in version 4.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 4.9.1 - Configuration
Ensure endpoints/currency/update_exchange.php loads the Fixer/API Layer credential for the authenticated user rather than using the first stored credential globally; this is the behavior fixed in version 4.9.1.
Wallos endpoints/currency/update_exchange.php Fixer/API Layer credential loading behavior = Load the credential for the authenticated user (not the first globally stored credential)
Event History
Frequently Asked Questions
Who can exploit this issue?
Any normal authenticated Wallos user can trigger the exchange-rate refresh endpoint. The user does not need to possess their own Fixer/API Layer provider key.
What is the practical impact?
Exchange-rate refresh requests can consume a provider credential stored by a different user, specifically the first credential loaded globally. The disclosed impact is unauthorized use of that credential for refresh activity; no confidentiality or availability impact is stated.
Are installations running version 4.9.1 affected?
No. The issue is described as affecting Wallos versions prior to 4.9.1 and as patched in version 4.9.1.
How can I determine whether an installation may be affected?
An installation may be affected if it runs a version before 4.9.1 and has users with stored Fixer/API Layer credentials. In that state, authenticated users without their own provider key may be able to initiate refreshes that use another user's credential.