Wallos exposes an endpoint (db/migrate.php) that applies database migrations over plain HTTP with no authentication. An attacker can trigger any pending migration scripts, altering the live SQLite database schema. This capability can lead to unauthorized data modification, loss of data integrity, and potential denial of service if critical tables are dropped or altered. The weakness is a classic authentication bypass (CWE‑306).

The vulnerable product is Wallos, an open‑source personal subscription tracker from Ellite. All installations running any version earlier than 4.9.4 are affected, including versions 4.9.3 and older.

The CVSS score of 7.5 indicates a high severity vulnerability, while the EPSS score is not currently available and the issue is not listed in the CISA KEV catalog. The attack vector is remote, over HTTP, meaning that any networked attacker who can reach the host can trigger the vulnerability. Successful exploitation requires only a crafted HTTP request and does not demand privileged credentials or local access. The potential impact is significant because the attacker can alter the database schema, compromising data availability and integrity.