CVE-2026-54600: Wallos Authentication Bypass Vulnerability

CVE-2026-54600 Overview

Wallos is an open-source, self-hostable personal subscription tracker. A missing authentication vulnerability in endpoints/db/import.php allows unauthenticated attackers to replace the entire application database on fresh or unconfigured installations. The only guard on the endpoint is a check for zero rows in the user table, so any Wallos instance that has not completed initial setup is exposed to full database takeover. The issue is fixed in Wallos version 4.9.4 [CWE-287].

Critical Impact
Unauthenticated network attackers can overwrite the Wallos database on unconfigured installations, achieving full data integrity compromise without credentials or user interaction.

Affected Products

Wallos self-hosted subscription tracker
All versions prior to 4.9.4
Deployments with an empty user table (fresh or unconfigured installs)

Discovery Timeline

2026-08-31 - CVE-2026-54600 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-54600

Vulnerability Analysis

The vulnerability resides in the endpoints/db/import.php handler, which processes database import requests. The endpoint performs no session or credential verification before accepting the uploaded database file. Instead, it relies on a single business logic check that counts rows in the user table and only rejects requests when at least one user exists.

This design assumes an install becomes trusted after the first user is created. In practice, any deployment that has not completed onboarding, including newly provisioned containers, staging instances, and abandoned setups, remains reachable by any network client. Successful exploitation replaces the SQLite database, allowing the attacker to seed arbitrary administrative accounts and subscription data.

Root Cause

The root cause is missing authentication on a state-changing endpoint [CWE-287]. The user-count guard conflates "no users configured" with "trusted setup context," which is not enforceable over the network. The application does not require a setup token, host binding, or authenticated session before allowing database replacement.

Attack Vector

The attack is remote over the network with low complexity and no privileges required. An attacker identifies a Wallos instance reachable on HTTP or HTTPS, verifies the user table is empty by probing setup behavior, and issues a crafted POST request to endpoints/db/import.php with a malicious database payload. After the import, the attacker logs in with credentials embedded in the replacement database and controls the application.

Refer to the GitHub Security Advisory GHSA-8wqc-r9j3-rv7m for the maintainer's technical description.

Detection Methods for CVE-2026-54600

Indicators of Compromise

POST requests to /endpoints/db/import.php from external or unexpected source IPs
Unexpected modification timestamps on the Wallos SQLite database file
Administrative accounts in the Wallos user table that were not created by operators
Sudden appearance of unfamiliar subscription entries or altered application settings after deployment

Detection Strategies

Alert on any HTTP request to endpoints/db/import.php that does not originate from an authenticated admin session
Baseline the Wallos database file hash after initial setup and alert on unauthorized changes
Correlate web server access logs with file integrity monitoring events on the Wallos data directory

Monitoring Recommendations

Enable verbose web server logging for the Wallos application path and forward logs to a central SIEM
Monitor for internet-exposed Wallos instances that have not completed first-user creation
Track container and deployment inventories to identify staging or forgotten instances still in the unconfigured state

How to Mitigate CVE-2026-54600

Immediate Actions Required

Upgrade all Wallos deployments to version 4.9.4 or later without delay
Complete initial user setup immediately on any newly deployed Wallos instance before exposing it to a network
Audit the user table and imported subscription data for entries that were not created by legitimate operators
Restrict network access to Wallos administrative endpoints using firewall or reverse proxy allowlists

Patch Information

The maintainer released the fix in Wallos v4.9.4, which adds authentication enforcement to the database import endpoint. Operators should upgrade the container image or source tree to v4.9.4 and restart the application. Review the GitHub Security Advisory GHSA-8wqc-r9j3-rv7m for the full patch notes.

Workarounds

Block external access to endpoints/db/import.php at the reverse proxy or web application firewall until the upgrade is applied
Ensure every Wallos instance has at least one configured user before exposing the service to any untrusted network
Place Wallos behind an authenticating reverse proxy that enforces credentials at the network edge

bash

# Example nginx snippet to block the vulnerable endpoint until patched
location = /endpoints/db/import.php {
    deny all;
    return 403;
}