CVE-2026-50199: Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-09-08
Weakness: CWE-863

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without their own provider key can trigger exchange-rate refreshes using another user's stored provider credential. This issue has been patched in version 4.9.1.

Affected products

ellite Wallos: before 4.9.1

References

https://github.com/ellite/Wallos/releases/tag/v4.9.1
https://github.com/ellite/Wallos/security/advisories/GHSA-5wf4-m4hj-rxj5
https://github.com/ellite/Wallos/security/advisories/GHSA-5wf4-m4hj-rxj5

Get alerted when CVE-2026-50199 or the next vulnerability affects your stack