Executive brief
Wallos is an open-source subscription tracker that allows users to manage their recurring payments and exchange rates. A flaw in the currency update endpoint causes it to use the first available currency provider credential instead of the current user's own credential. This allows any authenticated user to consume another user's API quota from third-party currency services and potentially manipulate their own currency conversion rates.
Technical details
The vulnerability is an incorrect authorization issue (CWE-863) in the endpoints/currency/update_exchange.php file. The vulnerable code queries for Fixer/API Layer credentials globally without scoping the query to the authenticated user, loading the first credential found in the database. An authenticated user without their own provider credential can POST to the update_exchange.php endpoint and trigger an exchange-rate refresh using another user's stored provider key. The attack requires authentication and network access but no special privileges. The impact is limited to unauthorized consumption of another user's third-party API quota and potential modification of the attacker's own currency rates. The vulnerability was patched in version 4.9.1.
Affected products
- Ellite Wallos prior to 4.9.1
Timeline
- 2026-05-27: disclosed
- 2026-05-27: patched