An unauthenticated remote attacker can trigger unauthorized database schema migrations in Wallos prior to version 4.9.4, posing a significant risk to data integrity.

This is a missing authentication for critical function vulnerability (CWE-306) located in the endpoints/db/migrate.php file. The application fails to perform any authentication checks, allowing an unauthenticated attacker to execute pending migration files against the live SQLite database.

The ability for an unauthenticated user to manipulate database schema structures presents a high risk to data integrity and system availability. Successful exploitation could lead to unauthorized database modifications, potential data loss, or the corruption of the application state. Given the CVSS score of 7.5, this vulnerability is classified as high severity, reflecting the ease of remote access and the potential impact on the core database operations of the subscription tracker.

Immediate Action: Update the Wallos installation to version 4.9.4 or later immediately to incorporate the required authentication checks.

Proactive Monitoring: Review web server access logs for unusual requests directed toward the endpoints/db/migrate.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or restrict access to the /endpoints/db/migrate.php path from external or untrusted network segments.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates immediate action, as it allows for direct, unauthenticated interaction with the underlying database schema. Administrators should prioritize upgrading to version 4.9.4 to remediate this flaw and prevent unauthorized database manipulation. Failure to apply this update leaves the application susceptible to critical integrity compromises.