Executive brief
Wallos is a self-hosted subscription tracker for personal financial management. An unauthenticated attacker can completely replace the application database on a fresh installation by uploading a ZIP file to the import endpoint, gaining instant administrative access and full control of the system without requiring any credentials.
Technical details
The vulnerability is an authentication bypass in endpoints/db/import.php that protects the database import functionality only with a user-table row count check—if zero users exist on a fresh installation, the endpoint allows unauthenticated database replacement. The root cause is the absence of proper authentication validation (connect_endpoint.php sets $userId to 0 without rejecting unauthenticated callers), relying instead on application state (data-based access control) rather than cryptographic authentication. An attacker can craft a malicious SQLite database with a known admin password hash, ZIP it, and POST it to the import endpoint on a fresh install to gain immediate administrative access. Established installations are also affected but return a "Denied" message with HTTP 200 rather than a proper 401/403 response. The fix, deployed in version 4.9.4, adds authentication checks via validate_endpoint_admin.php and implements setup-token gating for unauthenticated database restore.
Affected products
- Wallos Wallos <= 4.9.3
Timeline
- 2026-06-09: disclosed: GitHub security advisory GHSA-8wqc-r9j3-rv7m published
- 2026-06-06: patched: Version 4.9.4 released with authentication fix (note: marked as broken release; 4.9.5 recommended)
- 2026-08-31: other: CVE-2026-54600 published on NVD