CyberRota Analysis
AI-GeneratedThe vulnerability affects Wallos versions prior to 4.9.1, where the endpoint for updating exchange rates improperly uses a globally loaded API credential, allowing authenticated users to refresh exchange rates using another user's provider key. This could lead to unauthorized access to sensitive financial data and manipulation of exchange rates. Organizations using Wallos should prioritize upgrading to version 4.9.1 to mitigate potential risks associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without their own provider key can trigger exchange-rate refreshes using another user's stored provider credential. This issue has been patched in version 4.9.1.