CVE-2026-50198

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.1

Description An authenticated user can modify an inactive subscription by setting the replacement subscription id variable to a subscription ID belonging to another user. Because the stats logic dereferences this foreign ID without proper user id scoping, an attacker can infer the monthly-normalized cost of a victim's subscription by observing changes in their own statistics output. This allows the exposure of derived financial metadata without revealing the full subscription object.

Recommendations Update to version 4.9.1.