CVE-2026-30842

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.6.2

Description Wallos is a self-hostable personal subscription tracker. An authenticated user can delete avatar files uploaded by other users because the avatar deletion endpoint does not verify ownership. Any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. The vulnerable endpoint is the avatar deletion endpoint. The vulnerable variable is the avatar filename.

Recommendations Update to version 4.6.2 or later.