CVE-2026-50198 Wallos: Cross-user subscription cost inference via replacement_subscription_id

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacementsubscriptionid to a subscription ID belonging to another user. The write is accepted, and later the stats logic...

CVE-2026-50198

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1 , an authenticated user could edit their own inactive subscription and set the replacement_subscription_id field to a subscription ID belonging to another user. The write was accepted, and the stats logi...

CVE-2026-50198 Wallos: Cross-user subscription cost inference via replacement_subscription_id

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacementsubscriptionid to a subscription ID belonging to another user. The write is accepted, and later the stats logic...