CVE-2026-33400

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33400", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-19T17:02:34.170Z", "datePublished": "2026-03-24T17:45:27.144Z", "dateUpdated": "2026-03-24T20:21:38.544Z"}, "containers": {"cna": {"title": "Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ellite/Wallos/security/advisories/GHSA-p6v5-227f-f3fv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ellite/Wallos/security/advisories/GHSA-p6v5-227f-f3fv"}, {"name": "https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef", "tags": ["x_refsource_MISC"], "url": "https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef"}], "affected": [{"vendor": "ellite", "product": "Wallos", "versions": [{"version": "< 4.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-24T17:45:27.144Z"}, "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the wallos_login authentication cookie lacking the HttpOnly flag, this enables full session hijacking. This issue has been patched in version 4.7.0."}], "source": {"advisory": "GHSA-p6v5-227f-f3fv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T20:21:23.291915Z", "id": "CVE-2026-33400", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T20:21:38.544Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33400", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T20:21:23.291915Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T20:21:32.685Z"}}], "cna": {"title": "Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint", "source": {"advisory": "GHSA-p6v5-227f-f3fv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "ellite", "product": "Wallos", "versions": [{"status": "affected", "version": "< 4.7.0"}]}], "references": [{"url": "https://github.com/ellite/Wallos/security/advisories/GHSA-p6v5-227f-f3fv", "name": "https://github.com/ellite/Wallos/security/advisories/GHSA-p6v5-227f-f3fv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef", "name": "https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the wallos_login authentication cookie lacking the HttpOnly flag, this enables full session hijacking. This issue has been patched in version 4.7.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-24T17:45:27.144Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33400", "state": "PUBLISHED", "dateUpdated": "2026-03-24T20:21:38.544Z", "dateReserved": "2026-03-19T17:02:34.170Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-24T17:45:27.144Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Wallos", "vendor": "ellite", "versions": [{"status": "affected", "version": "< 4.7.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*", "matchCriteriaId": "7376DD5F-C93E-4454-810B-DE04B2DE7032", "versionEndExcluding": "4.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the wallos_login authentication cookie lacking the HttpOnly flag, this enables full session hijacking. This issue has been patched in version 4.7.0."}, {"lang": "es", "value": "Wallos es un rastreador de suscripciones personal de c\u00f3digo abierto y autoalojable. Antes de la versi\u00f3n 4.7.0, una vulnerabilidad de cross-site scripting (XSS) almacenado en el endpoint de renombrado de m\u00e9todo de pago permite a cualquier usuario autenticado inyectar JavaScript arbitrario que se ejecuta cuando cualquier usuario visita las p\u00e1ginas de Configuraci\u00f3n, Suscripciones o Estad\u00edsticas. Combinado con la cookie de autenticaci\u00f3n wallos_login que carece del flag HttpOnly, esto permite el secuestro completo de la sesi\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 4.7.0."}], "id": "CVE-2026-33400", "lastModified": "2026-06-17T10:37:25.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33400", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T20:21:23.291915Z", "version": "2.0.3"}}]}, "published": "2026-03-24T18:16:11.310", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/ellite/Wallos/security/advisories/GHSA-p6v5-227f-f3fv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.7.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Wallos", "source": "cna", "vendor": "ellite"}, "product": "wallos", "vendor": "ellite"}], "analysis": {"en": {"generated_at": "2026-03-26T21:56:24.138102+00:00", "value": {"mitigation_remediation": ["Upgrade Wallos to version\u202f4.7.0 or later to remove the XSS flaw.", "Configure the web server to set the HttpOnly flag on the wallos_login cookie to prevent JavaScript access to session data.", "If an upgrade is not immediately possible, restrict or revoke the ability of users to rename payment methods to limit the attack surface.", "Monitor for anomalous client\u2011side script activity and review logs for attempts to inject code."], "summary": {"action": "Immediate Patch", "impact": "Stored XSS leading to session hijacking"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all versions of ellite:Wallos, specifically the Wallos application, before version 4.7.0. Users of any earlier release are exposed. No specific sub\u2011versions are listed.", "description_and_impact": "Wallos is an open\u2011source, self\u2011hosted personal subscription tracker. A stored cross\u2011site scripting flaw exists in the payment method rename endpoint that allows any authenticated user to inject arbitrary JavaScript. The injected code runs when other users visit Settings, Subscriptions, or Statistics pages, giving the attacker the ability to steal or manipulate session data. Combined with the wallos_login cookie lacking the HttpOnly flag, successful exploitation can lead to full session hijacking.", "risk_and_exploitability": "The flaw has a CVSS v3 score of 5.4, placing it in the moderate range, and an EPSS score of less than 1\u202f%, indicating a low probability of exploitation. The vulnerability requires an authenticated user to trigger the rename action, so only users with valid credentials can exploit it. Because the injected code executes in another user's browser, legacy JavaScript could harvest the session cookie. The combination of stored XSS and a non\u2011HttpOnly authentication cookie enables complete session hijacking. The vulnerability is not currently listed in the CISA KEV catalog."}}}}, "created": "2026-03-25T11:46:52.155004+00:00", "updated": "2026-03-27T09:20:50.656439+00:00", "vendors": ["ellite", "ellite$PRODUCT$wallos"]}