CVE-2026-54598: Missing Authentication for Critical Function in wallos

Q: Which deployments are exposed?

Wallos deployments running a version prior to 4.9.4 are exposed if an attacker can reach endpoints/db/migrate.php over HTTP. The affected endpoint requires no authentication.

Q: What can an attacker do through the vulnerable endpoint?

An unauthenticated attacker can execute pending database schema migration files against the live SQLite database. Exploitation does not require credentials or user interaction.

Q: How can I remediate this issue?

Upgrade Wallos to version 4.9.4, which patches the issue.

Published Aug 31, 2026

Updated

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.

Affected Software

1 affected component

wallos<4.9.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wallos to a version that resolves this vulnerability.
Fixed in 4.9.4

Event History

Aug 31, 2026

CVE Published

via MITRE·08:28 PM

Data Sourced

via MITRE·08:28 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Wallos deployments running a version prior to 4.9.4 are exposed if an attacker can reach endpoints/db/migrate.php over HTTP. The affected endpoint requires no authentication.

What can an attacker do through the vulnerable endpoint?