CVE-2026-50199

Wallos , an open-source self-hostable personal subscription tracker, is affected in versions prior to 4.9.1 . The vulnerable component is endpoints/currency/update_exchange.php, which loads the first Fixer/API Layer credential globally rather than the credential belonging to the authenticated use...