Medium
Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
Type: advisorySources: OSV
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-30842
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 11:26 UTC · Revision 1
Source evidence
Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
core-osv · Original sourcePublished 7 Mar 2026, 05:41 UTC
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.
osv:CVE-2026-30842
Complete source record
{
"id": "032523f1bd883b3ccc32b218253f9d10ac5939a1d3879fa9f29dccb4b93073b7",
"url": "https://osv.dev/vulnerability/CVE-2026-30842",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars",
"summary": "Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.",
"evidence": "osv:CVE-2026-30842",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-30842",
"aliases": [
"CVE-2026-30842",
"GHSA-qw24-3pxr-3j6r"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ellite/wallos",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "8f0b5d0a84159b01091e3d57dd539e97f900a935"
},
{
"fixed": "e8a513591dbbf885966e2ef55c38622785b9060d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.6.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "e8a513591dbbf885966e2ef55c38622785b9060d"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "8f0b5d0a84159b01091e3d57dd539e97f900a935"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v4.6.2"
}
]
}
}
],
"versions": [
"v4.6.1",
"v4.6.0",
"v4.5.0",
"v4.4.1",
"v4.4.0",
"v4.3.0",
"v4.2.0",
"v4.1.1",
"v4.1.0",
"v4.0.0",
"v3.3.1",
"v3.3.0",
"v3.2.0",
"v3.1.1",
"v3.1.0",
"v3.0.2",
"v3.0.1",
"v3.0.0",
"v2.52.2",
"v2.52.1",
"v2.52.0",
"v2.51.1",
"v2.51.0",
"v2.50.1",
"v2.50.0",
"v2.49.1",
"v2.49.0",
"v2.48.1",
"v2.48.0",
"v2.47.1",
"v2.47.0",
"v2.46.1",
"v2.46.0",
"v2.45.2",
"v2.45.1",
"v2.45.0",
"v2.44.1",
"v2.44.0",
"v2.43.1",
"v2.43.0",
"v2.42.2",
"v2.42.1",
"v2.42.0",
"v2.41.0",
"v2.40.0",
"v2.39.1",
"v2.39.0",
"v2.38.3",
"v2.38.2",
"v2.38.1",
"v2.38.0",
"v2.37.1",
"v2.37.0",
"v2.36.2",
"v2.36.1",
"v2.36.0",
"v2.35.0",
"v2.34.0",
"v2.33.1",
"v2.33.0",
"v2.32.0",
"v2.31.1",
"v2.31.0",
"v2.30.1",
"v2.30.0",
"v2.29.2",
"v2.29.1",
"v2.29.0",
"v2.28.0",
"v2.27.3",
"v2.27.2",
"v2.27.1",
"v2.27.0",
"v2.26.0",
"v2.25.0",
"v2.24.1",
"v2.24.0",
"v2.23.2",
"v2.23.1",
"v2.23.0",
"v2.22.1",
"v2.22.0",
"v2.21.3",
"v2.21.2",
"v2.21.1",
"v2.21.0",
"v2.20.1",
"v2.20.0",
"v2.19.3",
"v2.19.2",
"v2.19.1",
"v2.19.0",
"v2.18.0",
"v2.17.0",
"v2.16.1",
"v2.16.0",
"v2.15.0",
"v2.14.2",
"v2.14.1",
"v2.14.0",
"v2.13.0",
"v2.12.0",
"v2.11.2",
"v2.11.1",
"v2.11.0",
"v2.10.0",
"v2.9.0",
"v2.8.0",
"v2.7.0",
"v2.6.1",
"v2.6.0",
"v2.5.2",
"v2.5.1",
"v2.5.0",
"v2.4.2",
"v2.4.1",
"v2.4.0",
"v2.3.0",
"v2.2.0",
"v2.1.0",
"v2.0.0",
"v1.29.1",
"v1.29.0",
"v1.28.0",
"v1.27.2",
"v1.27.1",
"v1.27.0",
"v1.26.2",
"v1.26.1",
"v1.26.0",
"v1.25.1",
"v1.25.0",
"v1.24.0",
"v1.23.0",
"v1.22.0",
"v1.21.1",
"v1.21.0",
"v1.20.2",
"v1.20.1",
"v1.20.0",
"v1.19.0",
"v1.18.3",
"v1.18.2",
"v1.18.1",
"v1.18.0",
"v1.17.3",
"v1.17.2",
"v1.17.1",
"v1.17.0",
"v1.16.3",
"v1.16.2",
"v1.16.1",
"v1.16.0",
"v1.15.3",
"v1.15.2",
"v1.15.1",
"v1.15.0",
"v1.14.1",
"v1.14.0",
"v1.13.0",
"v1.12.1",
"v1.12.0",
"v1.11.3",
"v1.11.2",
"v1.11.1",
"v1.11.0",
"v1.10.0",
"v1.9.1",
"v1.9.0",
"v1.8.3",
"v1.8.2",
"v1.8.1",
"v1.8.0",
"v1.7.0",
"v1.6.0",
"v1.5.0",
"v1.4.1",
"v1.4.0",
"v1.3.1",
"v1.3.0",
"v1.2.0",
"v1.1.0",
"v1.0.1",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30842.json"
}
}
],
"modified": "2026-10-28T02:30:43.779511230Z",
"provider": "osv",
"references": [
"https://github.com/ellite/Wallos/releases/tag/v4.6.2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30842.json",
"https://github.com/ellite/Wallos/security/advisories/GHSA-qw24-3pxr-3j6r",
"https://nvd.nist.gov/vuln/detail/CVE-2026-30842",
"https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30842.json"
}
},
"related_cves": [
{
"value": "CVE-2026-30842",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 511726,
"published_at": "2026-03-07T05:41:54.644+00:00"
}