CVE-2026-54598 — Missing Authentication for Critical Function in wallos
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP…
Published: 2026-08-31 · CVSS: 7.5 · CVSS 3.1
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7