CVE-2026-30842

low-risk

Published 2026-03-07

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.

Do I need to act?

0.01% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Wallos

Affected Vendors

Wallosapp

References (3)

Patch https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d

Release Notes https://github.com/ellite/Wallos/releases/tag/v4.6.2

Exploit https://github.com/ellite/Wallos/security/advisories/GHSA-qw24-3pxr-3j6r

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal