Executive brief
Wallos is an open-source personal subscription tracker that allows users to manage and organize their recurring payments in one place. A flaw in the database migration endpoint allows any attacker on the network to trigger database schema changes without logging in, potentially corrupting the application's data structure or executing malicious code if combined with write access.
Technical details
The vulnerability is a missing authentication check (CWE-306) in endpoints/db/migrate.php. The endpoint loads include files but never validates user authentication (no check of $_SESSION, $userId, or auth guards); instead, it immediately executes pending database migrations. An unauthenticated attacker can send an HTTP request to trigger arbitrary pending migration files via require_once, which executes DDL commands against the live SQLite database. If chained with a file write primitive, this can lead to remote code execution. The vulnerability affects versions prior to 4.9.4, which adds admin authentication validation. Attack vector is network-based with no authentication, complexity, or user interaction required.
Affected products
- ellite Wallos prior to 4.9.4
Timeline
- 2026-06-09: disclosed
- 2026-06-06: patched