Read the docs
TI-2026-23671 Aliases CVE-2026-30842

Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars

Priority MEDIUM 53CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00328 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Wallos (ellite): 4.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elliteWallosbefore 4.6.24.6.2Patch availableCNA
  • Wallos Vendorellite Affected before 4.6.2 Fixed in 4.6.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*before 4.6.2Vulnerableellite
  • cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:* Versions before 4.6.2 Vulnerable ·ellite

Remediation

  • Fix · CNA Wallos (ellite) Fixed in 4.6.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30842

References

Exploit 1

Patch 1

Other 1

  • TI-2026-25804 Wallos: SSRF via HTTP Proxy Environment Variable CVSS 4.0HIGH 8.3
  • TI-2026-23669 Wallos: Server-Side Request Forgery (SSRF) in Notification Testers CVSS 3.0HIGH 8.8
  • TI-2024-19429 Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. CVSS 3.1HIGH 8.1
  • TI-2026-25796 Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840 CVSS 3.1HIGH 7.7
  • TI-2026-21886 Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch CVSS 3.1HIGH 7.7
  • TI-2026-25814 Wallos: Password Reset Tokens Never Expire CVSS 3.1HIGH 7.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences