CVE-2026-54600: Wallos: Unauthenticated database replacement via import endpoint on fresh install
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in version 4.9.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallos endpoints/db/import.phpto a version that resolves this vulnerability.Fixed in 4.9.4
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated database replacement?
Wallos deployments running a version prior to 4.9.4 are exposed when they are fresh or unconfigured and the user table contains zero rows. Once the user table has at least one row, the described guard prevents this import endpoint from being used in the same way.
What does an attacker need to exploit this issue?
An attacker needs network access to the unauthenticated endpoints/db/import.php endpoint while the Wallos installation has no user-table rows. No authentication is required under that condition.
How can I determine whether my instance may have been vulnerable?
Check whether the instance was running a Wallos version earlier than 4.9.4 and whether its user table was empty, such as during initial setup or before configuration was completed. The issue specifically depends on the user-table row count being zero.
What should I do if I cannot patch immediately?
Complete initial configuration so that the user table contains at least one row, and restrict network access to the affected import endpoint where possible. Upgrade to Wallos 4.9.4 when feasible, as that version contains the patch.