Quick answers
- Is CVE-2026-50199 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-50199 being exploited in the wild.
- How severe is CVE-2026-50199?
- Medium severity, with a CVSS score of 4.3, published 31 August 2026.
- Which products and versions are affected?
- Ellite Wallos prior to 4.9.1.
- Is there a fix for CVE-2026-50199?
- A patch was published on 2026-05-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-50199 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-50199?
- Check whether you run Ellite Wallos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an incorrect authorization issue (CWE-863) in the endpoints/currency/update_exchange.php file. The vulnerable code queries for Fixer/API Layer credentials globally without scoping the query to the authenticated user, loading the first credential found in the database. An authenticated user without their own provider credential can POST to the update_exchange.php endpoint and trigger an exchange-rate refresh using another user's stored provider key. The attack requires authentication and network access but no special privileges. The impact is limited to unauthorized consumption of another user's third-party API quota and potential modification of the attacker's own currency rates. The vulnerability was patched in version 4.9.1.
Affected products
- Ellite Wallos prior to 4.9.1
Timeline
- 2026-05-27: disclosed
- 2026-05-27: patched