Executive brief
Wallos, an open-source personal subscription and expense tracker, contains a security flaw that could allow an attacker to perform unauthorized actions on behalf of a user. By tricking a logged-in user into clicking a malicious link or visiting a compromised website, an attacker could delete financial categories or currency settings without the user's consent. This could lead to data loss and disruption of the user's budget management and expense tracking.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Currencies and Categories management components of Wallos, specifically within the '/endpoints/currency/currency.php' and '/endpoints/categories/category.php' endpoints. The application fails to implement proper CSRF protections (such as anti-CSRF tokens) for sensitive state-changing operations performed via GET requests. An attacker can exploit this by crafting a malicious URL or HTML page that, when visited by an authenticated user, triggers the 'delete' action for specific category or currency IDs. This allows for unauthorized data modification or deletion without the user's knowledge. The vulnerability is confirmed in version 4.1.1 and earlier.
Affected products
- ellite Wallos 4.1.1 and earlier
Timeline
- 2025-10-14: advisory: CVE-2025-60535 published by MITRE/NVD