Is CVE-2026-54600 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54600 being exploited in the wild.

How severe is CVE-2026-54600?

Informational severity, with a CVSS score of 7.5, published 31 August 2026.

Is there a fix for CVE-2026-54600?

A patch was published on 2026-06-06: Version 4.9.4 released with authentication fix (note: marked as broken release; 4.9.5 recommended) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54600 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-54600?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54600: Wallos unauthenticated database replacement on fresh install

CVE-2026-54600 · Severity: info · CVSS 7.5 · Published 2026-08-31

Wallos is a self-hosted subscription tracker for personal financial management. An unauthenticated attacker can completely replace the application database on a fresh installation by uploading a ZIP file to the import endpoint, gaining instant administrative access and full control of the system without requiring any credentials.

Quick answers

Is CVE-2026-54600 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54600 being exploited in the wild.
How severe is CVE-2026-54600?: Informational severity, with a CVSS score of 7.5, published 31 August 2026.
Which products and versions are affected?: Wallos Wallos <= 4.9.3.
Is there a fix for CVE-2026-54600?: A patch was published on 2026-06-06: Version 4.9.4 released with authentication fix (note: marked as broken release; 4.9.5 recommended) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54600 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-54600?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in endpoints/db/import.php that protects the database import functionality only with a user-table row count check—if zero users exist on a fresh installation, the endpoint allows unauthenticated database replacement. The root cause is the absence of proper authentication validation (connect_endpoint.php sets $userId to 0 without rejecting unauthenticated callers), relying instead on application state (data-based access control) rather than cryptographic authentication. An attacker can craft a malicious SQLite database with a known admin password hash, ZIP it, and POST it to the import endpoint on a fresh install to gain immediate administrative access. Established installations are also affected but return a "Denied" message with HTTP 200 rather than a proper 401/403 response. The fix, deployed in version 4.9.4, adds authentication checks via validate_endpoint_admin.php and implements setup-token gating for unauthenticated database restore.

Affected products

Wallos Wallos <= 4.9.3

Timeline

2026-06-09: disclosed: GitHub security advisory GHSA-8wqc-r9j3-rv7m published
2026-06-06: patched: Version 4.9.4 released with authentication fix (note: marked as broken release; 4.9.5 recommended)
2026-08-31: other: CVE-2026-54600 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.