Wallos is an open‑source subscription tracking application that allows users to upload profile pictures. A flaw in the avatar deletion endpoint fails to verify the ownership of the requested file, so any authenticated user, if they know or can guess another user’s avatar filename, can delete that file. This lack of authorization permits unintended data removal but does not lead to code execution or broader system compromise.

The vulnerability exists in all Wallos releases prior to version 4.6.2 distributed by the vendor ellite:Wallos. Users running these older versions are susceptible; the patch was introduced in the 4.6.2 release. No other product versions are indicated as affected.

The CVSS score is 4.3, reflecting a moderate impact. The EPSS score is below 1%, indicating a very low likelihood of exploitation as of the latest data, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need authenticated access and knowledge of another user’s avatar filename, a condition that may be difficult to obtain without additional reconnaissance.