CVE-2026-54598: Missing Authentication for Critical Function in wallos

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-09-08
Weakness: CWE-306

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.

Affected products

ellite Wallos: before 4.9.4

References

https://github.com/ellite/Wallos/releases/tag/v4.9.4
https://github.com/ellite/Wallos/security/advisories/GHSA-fgfx-rc43-4rr7
https://github.com/ellite/Wallos/security/advisories/GHSA-fgfx-rc43-4rr7

Get alerted when CVE-2026-54598 or the next vulnerability affects your stack