CyberRota Analysis
AI-GeneratedWallos versions prior to 4.9.1 are vulnerable, allowing authenticated users to manipulate their inactive subscriptions by setting a replacement subscription ID belonging to another user. This flaw enables attackers to infer sensitive financial metadata, such as the monthly-normalized cost of a victim's subscription, through their own stats output. Organizations using Wallos should prioritize updating to version 4.9.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign subscription ID without user_id scoping. This lets the attacker infer the victim subscription's monthly-normalized cost by observing changes in their own stats output. This does not expose the full victim subscription object, but it does expose derived financial metadata. This issue has been patched in version 4.9.1.