CVE-2026-50199: Wallos Authentication Bypass Vulnerability

CVE-2026-50199 Overview

CVE-2026-50199 is a broken authorization vulnerability [CWE-863] in Wallos, an open-source self-hosted personal subscription tracker. The flaw resides in the endpoints/currency/update_exchange.php endpoint, which loads the first Fixer or API Layer credential globally instead of the credential belonging to the authenticated user. An authenticated user without their own provider key can trigger exchange-rate refreshes using another user's stored credential. The maintainer released a patch in Wallos version 4.9.1.

Critical Impact
Authenticated users can consume another user's third-party API quota and indirectly disclose that a provider credential exists on the instance, breaking tenant isolation in multi-user Wallos deployments.

Affected Products

Wallos versions prior to 4.9.1
Self-hosted multi-user Wallos deployments
Instances integrating Fixer or API Layer exchange-rate providers

Discovery Timeline

2026-08-31 - CVE-2026-50199 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-50199

Vulnerability Analysis

Wallos supports multiple users, and each user can configure their own Fixer or API Layer credential to refresh currency exchange rates. The endpoints/currency/update_exchange.php endpoint is intended to use the calling user's stored credential. Instead, the endpoint queries the database and selects the first provider credential it finds without filtering by the authenticated user's identifier.

Any authenticated session that hits the endpoint reuses that first-returned credential. A low-privileged user who never provided a key can therefore invoke exchange-rate refreshes that consume quota belonging to another tenant. The issue is classified as incorrect authorization [CWE-863] because the code enforces authentication but skips the ownership check on the provider record.

Root Cause

The root cause is a missing per-user predicate in the database lookup for provider credentials. The query returns the globally first Fixer or API Layer row rather than scoping the lookup with the session user identifier. The result is a shared-credential path in what is documented as a per-user configuration model.

Attack Vector

The attack requires network access to the Wallos instance and a valid low-privileged account. The attacker sends an authenticated request to endpoints/currency/update_exchange.php and forces the server to invoke the upstream exchange-rate provider with the victim's credential. No user interaction is required from the victim. Impact is limited to integrity of another user's API usage and confirmation that a provider credential is configured on the instance.

See the GitHub Security Advisory GHSA-5wf4-m4hj-rxj5 for the maintainer's technical description.

Detection Methods for CVE-2026-50199

Indicators of Compromise

Requests to endpoints/currency/update_exchange.php originating from user sessions that have no configured Fixer or API Layer credential.
Unexpected spikes in Fixer or API Layer quota consumption reported by the upstream provider dashboard.
Exchange-rate refresh events in Wallos logs correlated with user accounts that historically never triggered them.

Detection Strategies

Correlate web-server access logs for update_exchange.php with the Wallos user database to flag calls from users lacking a provider key.
Enable audit logging on currency-refresh actions and alert when the acting user identifier does not match the credential owner.
Monitor outbound calls to api.apilayer.com and data.fixer.io and reconcile call counts with per-user activity.

Monitoring Recommendations

Track HTTP 200 responses to update_exchange.php per authenticated user identifier over rolling windows.
Alert on any non-admin account invoking currency refresh more than a defined baseline per day.
Review Wallos application logs after upgrade for historical patterns matching the abuse behavior.

How to Mitigate CVE-2026-50199

Immediate Actions Required

Upgrade Wallos to version 4.9.1 or later, available at the Wallos v4.9.1 Release.
Rotate any Fixer and API Layer credentials stored in Wallos prior to the upgrade, since usage may have been consumed by other accounts.
Audit the user list and disable accounts that should not exist on the instance.

Patch Information

The maintainer fixed the flaw in Wallos 4.9.1 by scoping the provider-credential lookup in endpoints/currency/update_exchange.php to the authenticated user. Administrators should pull the tagged release and redeploy. Refer to the Wallos v4.9.1 Release notes and the GitHub Security Advisory GHSA-5wf4-m4hj-rxj5 for change details.

Workarounds

Restrict Wallos to a single trusted user until the instance is upgraded.
Remove Fixer and API Layer credentials from user profiles to prevent cross-user reuse during the window before patching.
Place Wallos behind an authenticating reverse proxy that blocks endpoints/currency/update_exchange.php for non-admin users.

bash

# Example: block the vulnerable endpoint for non-admin sessions at an nginx reverse proxy
location = /endpoints/currency/update_exchange.php {
    allow 10.0.0.10;   # admin workstation
    deny  all;
}