CVE-2026-50198 Overview
Wallos is an open-source, self-hostable personal subscription tracker. CVE-2026-50198 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting Wallos versions prior to 4.9.1. An authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The application accepts the write, and stats logic later dereferences the foreign subscription ID without user_id scoping. Attackers can then infer the victim's monthly-normalized subscription cost by observing changes in their own stats output. The maintainers patched the flaw in version 4.9.1.
Critical Impact
Authenticated attackers can derive financial metadata from other users' subscriptions by exploiting missing user scoping on the replacement_subscription_id field.
Affected Products
- Wallos versions prior to 4.9.1
- Self-hosted Wallos instances with multiple user accounts
- Wallos deployments exposing the stats endpoint to authenticated users
Discovery Timeline
- 2026-08-31 - CVE-2026-50198 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-50198
Vulnerability Analysis
The flaw resides in the subscription editing workflow. Wallos allows a user to mark a subscription as replaced by another subscription using the replacement_subscription_id field. On write, the application does not verify that the referenced subscription belongs to the requesting user.
The stats aggregation logic subsequently reads this foreign identifier and includes the referenced subscription's normalized cost in the attacker's own statistics output. This produces an observable delta that reveals the victim subscription's monthly-normalized price. The full subscription object remains hidden, but derived financial metadata leaks across tenant boundaries.
Root Cause
The root cause is missing authorization scoping on the replacement_subscription_id write path and on the downstream stats read path. Neither operation enforces that the referenced subscription's user_id matches the session user. This is a classic IDOR pattern cataloged as CWE-639: Authorization Bypass Through User-Controlled Key.
Attack Vector
An authenticated attacker with any valid Wallos account performs the following steps. First, the attacker creates or identifies one of their own inactive subscriptions. Next, the attacker submits an edit request setting replacement_subscription_id to a guessed or enumerated ID belonging to another user. Finally, the attacker requests their stats view and observes the change in the monthly-normalized total, which reveals the victim subscription's cost. See the GitHub Security Advisory GHSA-hggr-v8rm-c6jj for technical details.
Detection Methods for CVE-2026-50198
Indicators of Compromise
- Edit requests to subscription endpoints where the submitted replacement_subscription_id does not exist in the requesting user's subscription set.
- Anomalous fluctuations in a user's stats output that correlate with edits to inactive subscriptions.
- Repeated subscription edit attempts iterating through sequential replacement_subscription_id values, suggesting ID enumeration.
Detection Strategies
- Audit application logs for subscription update requests and cross-reference the submitted replacement_subscription_id with the owning user_id in the database.
- Alert when a single account performs many subscription edits in a short interval, which is consistent with brute-force ID probing.
- Compare stats endpoint response deltas against the requesting user's own subscription changes to identify cross-tenant contamination.
Monitoring Recommendations
- Enable verbose HTTP request logging on the Wallos reverse proxy and retain access logs for review.
- Monitor database queries that read subscriptions without a user_id filter and flag them for code review.
- Track authenticated user activity patterns to detect scripted enumeration of subscription identifiers.
How to Mitigate CVE-2026-50198
Immediate Actions Required
- Upgrade all Wallos instances to version 4.9.1 or later without delay.
- Review recent subscription edit history for suspicious replacement_subscription_id values that reference IDs outside the editing user's account.
- Restrict Wallos access to trusted users on multi-tenant self-hosted deployments until the patch is applied.
Patch Information
The issue is fixed in Wallos 4.9.1. Download the patched release from the Wallos v4.9.1 GitHub release page. The fix enforces user_id scoping when validating replacement_subscription_id writes and when dereferencing the ID in stats logic.
Workarounds
- Limit Wallos to single-user deployments until the upgrade is completed, since the flaw requires a multi-user environment to abuse.
- Place Wallos behind an authenticating reverse proxy that restricts which accounts can reach the subscription edit endpoints.
- Temporarily disable the stats view for non-administrative users to break the observation channel required for exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
