CVE-2026-50198

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1 , an authenticated user could edit their own inactive subscription and set the replacement_subscription_id field to a subscription ID belonging to another user. The write was accepted, and the stats logi...