---
id: CVE-2026-50198
title: 'Wallos is an open-source, self-hostable personal subscription tracker'
summary: >-
  Wallos is an open-source, self-hostable personal subscription tracker. Prior
  to version 4.9.1, an authenticated user can edit their own inactive
  subscription and set replacement_subscription_id to a subscription ID
  belonging to another u…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
published: '2026-08-31'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:11:31.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50198'
references:
  - url: 'https://github.com/ellite/Wallos/releases/tag/v4.9.1'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-hggr-v8rm-c6jj'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-hggr-v8rm-c6jj'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00294
epssPercentile: 0.19602
ingestedAt: '2026-09-08T22:12:30.944Z'
---

## Overview

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign subscription ID without user_id scoping. This lets the attacker infer the victim subscription's monthly-normalized cost by observing changes in their own stats output. This does not expose the full victim subscription object, but it does expose derived financial metadata. This issue has been patched in version 4.9.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.