CVE-2026-30842— Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
Quick assessment
Affected
ellite Wallos
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Wallos是Miguel Ribeiro个人开发者的一个开源个人订阅跟踪器。 Wallos 4.6.2之前版本存在安全漏洞，该漏洞源于头像删除端点未验证请求的头像是否属于当前用户，可能导致经过身份验证的用户删除其他用户上传的头像文件。
Possible ATT&CK Techniques 1 AI
T1565.001 · Stored Data Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-30842
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
Source: CVE Program / CVE List V5
Vulnerability Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Wallos 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wallos是Miguel Ribeiro个人开发者的一个开源个人订阅跟踪器。 Wallos 4.6.2之前版本存在安全漏洞，该漏洞源于头像删除端点未验证请求的头像是否属于当前用户，可能导致经过身份验证的用户删除其他用户上传的头像文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-30842
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-30842
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-30842 (1)
Vendor Advisories for CVE-2026-30842 (1)
Vendor Pages for CVE-2026-30842 (1)
-
Release v4.6.2 · ellite/Wallos · GitHub x_refsource_MISC
Same Patch Batch · ellite · 2026-03-07 · 5 CVEs total
| CVE-2026-30841 | Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php | |
| CVE-2026-30839 | Wallos: SSRF via webhook test endpoint | |
| CVE-2026-30828 | Wallos: SSRF via url parameter leading to File Traversal | |
| CVE-2026-30840 | Wallos: Server-Side Request Forgery (SSRF) in Notification Testers |
IV. Related Vulnerabilities
Same product: Wallos
-
CVE-2026-77353
Wallos: iCalendar Injection via CRLF in Subscription Name/No -
CVE-2026-77352
Wallos: Authenticated SSRF via per-user SMTP notification ho -
CVE-2026-77348
Wallos incomplete fix for CVE-2026-33407: unauthenticated ht -
CVE-2026-77351
Wallos: SSRF via Unvalidated User-Level SMTP Host in Email N -
CVE-2026-61641
Wallos: OIDC account takeover via email-based account linkin
Same vendor: ellite
-
CVE-2026-77353
Wallos: iCalendar Injection via CRLF in Subscription Name/No -
CVE-2026-77352
Wallos: Authenticated SSRF via per-user SMTP notification ho -
CVE-2026-77348
Wallos incomplete fix for CVE-2026-33407: unauthenticated ht -
CVE-2026-77351
Wallos: SSRF via Unvalidated User-Level SMTP Host in Email N -
CVE-2026-61641
Wallos: OIDC account takeover via email-based account linkin
V. Comments for CVE-2026-30842
No comments yet