CVE-2026-30842

Katalog CVE

CVSS 4.3 · Medium EPSS 0,35%

Kerentanan Missing Authorization pada wallosapp wallos. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.

Rincian

Terbit di NVD

7 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ellite/Wallos/security/advisories/GHSA-qw24-3pxr-3j6r exploit · advisory vendor
• https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d patch
• https://github.com/ellite/Wallos/releases/tag/v4.6.2 release notes