# CVE-2026-54598: Wallos unauthenticated database migration execution

Source: https://junglewise.ai/threats/cve-2026-54598-wallos-unauthenticated-database-migration-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54598 · Severity: high · CVSS 7.5 · Published 2026-08-31

Wallos is an open-source personal subscription tracker that allows users to manage and organize their recurring payments in one place. A flaw in the database migration endpoint allows any attacker on the network to trigger database schema changes without logging in, potentially corrupting the application's data structure or executing malicious code if combined with write access.

Technologies: [Ellite Wallos](https://junglewise.ai/threats/technologies/wallos). Vendors: [Ellite](https://junglewise.ai/threats/vendors/ellite).

## Quick answers

**Is CVE-2026-54598 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54598 being exploited in the wild.

**How severe is CVE-2026-54598?** High severity, with a CVSS score of 7.5, published 31 August 2026.

**Which products and versions are affected?** Ellite Wallos prior to 4.9.4.

**Is there a fix for CVE-2026-54598?** A patch was published on 2026-06-06. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54598 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54598?** Check whether you run Ellite Wallos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authentication check (CWE-306) in endpoints/db/migrate.php. The endpoint loads include files but never validates user authentication (no check of $_SESSION, $userId, or auth guards); instead, it immediately executes pending database migrations. An unauthenticated attacker can send an HTTP request to trigger arbitrary pending migration files via require_once, which executes DDL commands against the live SQLite database. If chained with a file write primitive, this can lead to remote code execution. The vulnerability affects versions prior to 4.9.4, which adds admin authentication validation. Attack vector is network-based with no authentication, complexity, or user interaction required.

## Affected products

- ellite Wallos prior to 4.9.4

## Timeline

- 2026-06-09: disclosed
- 2026-06-06: patched

## References

- [https://github.com/ellite/Wallos/releases/tag/v4.9.4](https://github.com/ellite/Wallos/releases/tag/v4.9.4)
- [https://github.com/ellite/Wallos/security/advisories/GHSA-fgfx-rc43-4rr7](https://github.com/ellite/Wallos/security/advisories/GHSA-fgfx-rc43-4rr7)

## Related threats

- [Wallos CRLF injection in iCalendar export](https://junglewise.ai/threats/cve-2026-77353-wallos-crlf-injection-in-icalendar-export)
- [Wallos OIDC account takeover via unverified email linking](https://junglewise.ai/threats/cve-2026-61641-wallos-oidc-account-takeover-via-unverified-email-linking)
- [Wallos OIDC state validation missing in login CSRF](https://junglewise.ai/threats/cve-2026-54599-wallos-oidc-state-validation-missing-in-login-csrf)
- [Wallos incorrect authorization in exchange-rate refresh](https://junglewise.ai/threats/cve-2026-50199-wallos-incorrect-authorization-in-exchange-rate-refresh)
- [Wallos cross-user subscription cost inference via replacement_subscription_id](https://junglewise.ai/threats/cve-2026-50198-wallos-cross-user-subscription-cost-inference-via-replacement)