Authentication Weakness in Wallos Subscription Tracker by Ellite

CVE-2026-50198

What is CVE-2026-50198?

Wallos, an open-source personal subscription tracker, experienced a vulnerability before version 4.9.1 that allowed authenticated users to manipulate their inactive subscriptions. By setting a replacement_subscripion_id to another user's subscription ID, attackers could exploit this flaw. Although not exposing the entire subscription object, this manipulation led to the leakage of financial metadata, allowing the attacker to infer monthly costs associated with the victim’s subscriptions through their own stats output. This security issue has been addressed in version 4.9.1.

References