---
id: CVE-2026-50199
title: 'Wallos is an open-source, self-hostable personal subscription tracker'
summary: >-
  Wallos is an open-source, self-hostable personal subscription tracker. Prior
  to version 4.9.1, endpoints/currency/update_exchange.php loads the first
  Fixer/API Layer credential globally instead of loading the credential for the
  authentic…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-863
published: '2026-08-31'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:11:31.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50199'
references:
  - url: 'https://github.com/ellite/Wallos/releases/tag/v4.9.1'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-5wf4-m4hj-rxj5'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-5wf4-m4hj-rxj5'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00264
epssPercentile: 0.16271
ingestedAt: '2026-09-08T22:12:30.944Z'
---

## Overview

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without their own provider key can trigger exchange-rate refreshes using another user's stored provider credential. This issue has been patched in version 4.9.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.