CVE-2026-50198

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50198
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50198.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50198
Aliases
  • GHSA-hggr-v8rm-c6jj
Published
2026-08-31T20:25:20.459Z
Modified
2026-09-02T03:47:19.186868995Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Wallos: Cross-user subscription cost inference via replacement_subscription_id
Details

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacementsubscriptionid to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign subscription ID without user_id scoping. This lets the attacker infer the victim subscription's monthly-normalized cost by observing changes in their own stats output. This does not expose the full victim subscription object, but it does expose derived financial metadata. This issue has been patched in version 4.9.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50198.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/ellite/wallos

Affected ranges

Type
GIT
Repo
https://github.com/ellite/wallos
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9acdb99ed3d5f8846534deaa71db7c3eb53645f8
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.9.1"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1.0
v1.10.0
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.1
v1.13.0
v1.14.0
v1.14.1
v1.15.0
v1.15.1
v1.15.2
v1.15.3
v1.16.0
v1.16.1
v1.16.2
v1.16.3
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.18.0
v1.18.1
v1.18.2
v1.18.3
v1.19.0
v1.2.0
v1.20.0
v1.20.1
v1.20.2
v1.21.0
v1.21.1
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.25.1
v1.26.0
v1.26.1
v1.26.2
v1.27.0
v1.27.1
v1.27.2
v1.28.0
v1.29.0
v1.29.1
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.9.0
v1.9.1
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.11.0
v2.11.1
v2.11.2
v2.12.0
v2.13.0
v2.14.0
v2.14.1
v2.14.2
v2.15.0
v2.16.0
v2.16.1
v2.17.0
v2.18.0
v2.19.0
v2.19.1
v2.19.2
v2.19.3
v2.2.0
v2.20.0
v2.20.1
v2.21.0
v2.21.1
v2.21.2
v2.21.3
v2.22.0
v2.22.1
v2.23.0
v2.23.1
v2.23.2
v2.24.0
v2.24.1
v2.25.0
v2.26.0
v2.27.0
v2.27.1
v2.27.2
v2.27.3
v2.28.0
v2.29.0
v2.29.1
v2.29.2
v2.3.0
v2.30.0
v2.30.1
v2.31.0
v2.31.1
v2.32.0
v2.33.0
v2.33.1
v2.34.0
v2.35.0
v2.36.0
v2.36.1
v2.36.2
v2.37.0
v2.37.1
v2.38.0
v2.38.1
v2.38.2
v2.38.3
v2.39.0
v2.39.1
v2.4.0
v2.4.1
v2.4.2
v2.40.0
v2.41.0
v2.42.0
v2.42.1
v2.42.2
v2.43.0
v2.43.1
v2.44.0
v2.44.1
v2.45.0
v2.45.1
v2.45.2
v2.46.0
v2.46.1
v2.47.0
v2.47.1
v2.48.0
v2.48.1
v2.49.0
v2.49.1
v2.5.0
v2.5.1
v2.5.2
v2.50.0
v2.50.1
v2.51.0
v2.51.1
v2.52.0
v2.52.1
v2.52.2
v2.6.0
v2.6.1
v2.7.0
v2.8.0
v2.9.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v4.*
v4.0.0
v4.1.0
v4.1.1
v4.2.0
v4.3.0
v4.4.0
v4.4.1
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.8.0
v4.8.1
v4.8.2
v4.8.3
v4.8.4
v4.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50198.json"