Wallos is a self‑hosted subscription tracker that allows a database import through the endpoint db/import.php. Prior to version 4.9.4 this endpoint was exposed without any authentication. The only protection is a check that the users table is empty; when it is zero – as on a fresh or unconfigured installation – an unauthenticated attacker can submit a crafted request and completely replace the database. This results in loss of all stored subscription data and an ability to inject arbitrary records, effectively taking full control of the system’s data store.

All installations of the Wallos product from the vendor ellite running a version older than 4.9.4 are affected. The vulnerability is only present on fresh deployments where the users table has not yet been populated; configurations that already contain users are not susceptible.

The CVSS score of 8.2 classifies this flaw as high severity. No EPSS value is published, but the lack of authentication makes exploitation straightforward for anyone who can reach the import endpoint over the network. The weakness is a direct authentication bypass (CWE-287). The flaw is not listed in CISA's KEV catalog. An attacker would likely target exposed installations and could replace the database remotely, leading to data loss and a complete compromise of the application state.