---
id: CVE-2026-54598
title: 'Wallos is an open-source, self-hostable personal subscription tracker'
summary: >-
  Wallos is an open-source, self-hostable personal subscription tracker. Prior
  to version 4.9.4, endpoints/db/migrate.php executes database schema migrations
  when called over HTTP with zero authentication. Any unauthenticated attacker
  can …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-306
published: '2026-08-31'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:11:31.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54598'
references:
  - url: 'https://github.com/ellite/Wallos/releases/tag/v4.9.4'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-fgfx-rc43-4rr7'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-fgfx-rc43-4rr7'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00315
epssPercentile: 0.24696
ingestedAt: '2026-09-08T22:12:30.944Z'
---

## Overview

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.