Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign subscription ID without user_id scoping. This lets the attacker infer the victim subscription's monthly-normalized cost by observing changes in their own stats output. This does not expose the full victim subscription object, but it does expose derived financial metadata. This issue has been patched in version 4.9.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T21:17:08.700Z",
  "pubdate": "2026-08-31T21:17:08.700Z",
  "executiveSummary": "Wallos versions prior to 4.9.1 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to leak sensitive financial metadata belonging to other system users.\nThe vulnerability resides in the subscription management logic, where the replacement_subscription_id parameter fails to enforce server-side ownership validation.\nBy manipulating this field, an attacker can link their own inactive subscription to an arbitrary subscription ID owned by another user. Subsequent processing by the system's statistics engine dereferences the cross-user subscription ID without checking the associated user_id scope.\nThis behavior enables the inference of monthly-normalized financial values from the victim's subscription, facilitating information disclosure regarding another user's recurring expenses.\nExploitation requires a valid authenticated session, but the impact is significant as it breaks multi-tenant data isolation constraints. Users should upgrade to version 4.9.1 or later to implement the required access control checks and scoping logic.",
  "technicalDetails": "The vulnerability is an IDOR-based information disclosure flaw stemming from insufficient authorization checks during subscription updates. In affected versions of Wallos, the API endpoint responsible for modifying subscription objects fails to validate whether the provided replacement_subscription_id corresponds to a record owned by the authenticated user initiating the request.\nThe attack flow begins when an attacker identifies or guesses the internal database primary key (subscription ID) of a victim's subscription. The attacker then issues a legitimate update request to their own inactive subscription, injecting the victim's subscription ID into the replacement_subscription_id field. The backend application accepts this input and persists the illicit linkage in the database without performing a cross-reference validation against the session's user_id.\nThe technical root cause lies in the application's statistics calculation module. When the application aggregates financial data for user dashboards, it iterates through subscription records and dereferences the replacement_subscription_id to calculate recurring costs and normalized monthly expenditures. Because the stats generation logic treats the input ID as trusted and lacks scoped queries (e.g., SELECT ... FROM subscriptions WHERE id = ? AND user_id = ?), it processes the victim's subscription data as if it were part of the attacker's own financial portfolio.\nAs the attacker modifies their own subscription settings, the resulting change in the calculated dashboard stats effectively reveals the monthly-normalized cost of the victim's subscription. While the full subscription object—such as explicit names or internal notes—is not returned in the HTTP response, the side-channel inference of financial metadata is possible. This represents a breakdown in the logical separation of data between tenants in a self-hosted environment. The vulnerability is fixed in version 4.9.1, where the application logic was updated to strictly validate that any referenced replacement_subscription_id belongs to the authenticated user before allowing the link to persist or be utilized in financial computations."
}