CVE-2026-30842

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30842", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-05T21:06:44.607Z", "datePublished": "2026-03-07T05:41:54.644Z", "dateUpdated": "2026-03-10T17:58:23.693Z"}, "containers": {"cna": {"title": "Wallos: Authenticated Missing Authorization Allows Deletion of Other Users\u2019 Uploaded Avatars", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ellite/Wallos/security/advisories/GHSA-qw24-3pxr-3j6r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ellite/Wallos/security/advisories/GHSA-qw24-3pxr-3j6r"}, {"name": "https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d", "tags": ["x_refsource_MISC"], "url": "https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d"}, {"name": "https://github.com/ellite/Wallos/releases/tag/v4.6.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/ellite/Wallos/releases/tag/v4.6.2"}], "affected": [{"vendor": "ellite", "product": "Wallos", "versions": [{"version": "< 4.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-07T05:41:54.644Z"}, "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2."}], "source": {"advisory": "GHSA-qw24-3pxr-3j6r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T17:46:19.170772Z", "id": "CVE-2026-30842", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:58:23.693Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30842", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T17:46:19.170772Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:50:40.601Z"}}], "cna": {"title": "Wallos: Authenticated Missing Authorization Allows Deletion of Other Users\u2019 Uploaded Avatars", "source": {"advisory": "GHSA-qw24-3pxr-3j6r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ellite", "product": "Wallos", "versions": [{"status": "affected", "version": "< 4.6.2"}]}], "references": [{"url": "https://github.com/ellite/Wallos/security/advisories/GHSA-qw24-3pxr-3j6r", "name": "https://github.com/ellite/Wallos/security/advisories/GHSA-qw24-3pxr-3j6r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d", "name": "https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ellite/Wallos/releases/tag/v4.6.2", "name": "https://github.com/ellite/Wallos/releases/tag/v4.6.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-07T05:41:54.644Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30842", "state": "PUBLISHED", "dateUpdated": "2026-03-10T17:58:23.693Z", "dateReserved": "2026-03-05T21:06:44.607Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-07T05:41:54.644Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Wallos", "vendor": "ellite", "versions": [{"status": "affected", "version": "< 4.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*", "matchCriteriaId": "0369A77F-C023-4EE5-873B-7466F873A8A9", "versionEndExcluding": "4.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2."}, {"lang": "es", "value": "Wallos es un rastreador de suscripciones personal de c\u00f3digo abierto y autoalojable. Antes de la versi\u00f3n 4.6.2, Wallos permite a un usuario autenticado eliminar archivos de avatar subidos por otros usuarios. El endpoint de eliminaci\u00f3n de avatares no verifica que el avatar solicitado pertenezca al usuario actual. Como resultado, cualquier usuario autenticado que conozca o pueda descubrir el nombre de archivo del avatar subido de otro usuario puede eliminar ese archivo. Este problema ha sido parcheado en la versi\u00f3n 4.6.2."}], "id": "CVE-2026-30842", "lastModified": "2026-06-17T10:33:00.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30842", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T17:46:19.170772Z", "version": "2.0.3"}}]}, "published": "2026-03-07T06:16:11.763", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ellite/Wallos/releases/tag/v4.6.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/ellite/Wallos/security/advisories/GHSA-qw24-3pxr-3j6r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.6.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Wallos", "source": "cna", "vendor": "ellite"}, "product": "wallos", "vendor": "ellite"}], "analysis": {"en": {"generated_at": "2026-04-16T10:59:38.016518+00:00", "value": {"mitigation_remediation": ["Update Wallos to version 4.6.2 or later, which enforces proper authorization on avatar deletion.", "If an immediate upgrade is not possible, disable or remove the avatar deletion API for non\u2011administrator accounts or reconfigure role permissions to restrict delete access to avatar owners.", "Verify the integrity of existing avatars and consider revoking or rotating affected users\u2019 passwords to rule out unauthorized activity, then review audit logs for recent deletion attempts."], "summary": {"action": "Apply Patch", "impact": "Unauthorized deletion of user avatars"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in all Wallos releases prior to version 4.6.2 distributed by the vendor ellite:Wallos. Users running these older versions are susceptible; the patch was introduced in the 4.6.2 release. No other product versions are indicated as affected.", "description_and_impact": "Wallos is an open\u2011source subscription tracking application that allows users to upload profile pictures. A flaw in the avatar deletion endpoint fails to verify the ownership of the requested file, so any authenticated user, if they know or can guess another user\u2019s avatar filename, can delete that file. This lack of authorization permits unintended data removal but does not lead to code execution or broader system compromise.", "risk_and_exploitability": "The CVSS score is 4.3, reflecting a moderate impact. The EPSS score is below 1%, indicating a very low likelihood of exploitation as of the latest data, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need authenticated access and knowledge of another user\u2019s avatar filename, a condition that may be difficult to obtain without additional reconnaissance."}}}}, "created": "2026-03-09T10:05:49.447437+00:00", "updated": "2026-04-16T11:00:10.678819+00:00", "vendors": ["ellite", "ellite$PRODUCT$wallos"]}