Wallos

v4.9.4 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Dashboards & Home Pages

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

budgeting docker finance php self-hosted subscription-tracker

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 1mo

Version v4.9.4 of the release is broken and fails to start containers; use version 4.9.5 instead.

Why it matters: If you attempt to run v4.9.4, container startup will fail; switch immediately to v4.9.5.

Summary

AI summary

Broken release — container fails to start; use version 4.9.5 instead.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Secure unauthenticated db restore endpoint with a setup token Secure unauthenticated db restore endpoint with a setup token Source: llm_adapter@2026-06-06 Confidence: high	—
Security	High	Validate OIDC state parameter to prevent CSRF login attack Validate OIDC state parameter to prevent CSRF login attack Source: llm_adapter@2026-06-06 Confidence: high	—
Breaking	High	Container fails to start in release 4.9.4 Container fails to start in release 4.9.4 Source: granite4.1:30b@2026-06-06-audit Confidence: low	—
Bugfix	Medium	Restrict migrate.php to CLI and admin session only Restrict migrate.php to CLI and admin session only Source: llm_adapter@2026-06-06 Confidence: high	—

Full changelog

4.9.4 (2026-06-06)

⚠️ Broken release — container fails to start. Use 4.9.5 instead.

Bug Fixes

restrict migrate.php to CLI and admin session (85bba48)
secure unauthenticated db restore endpoint with a setup token (85bba48)
validate oidc state parameter to prevent csrf login attack (85bba48)

Breaking Changes

v4.9.4 is a broken release that fails to start; requires upgrading to v4.9.5

Security Fixes

Secure unauthenticated db restore endpoint with setup token
Validate OIDC state parameter to prevent CSRF login attack

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Wallos

Get notified when new releases ship.

About Wallos

Wallos: Open-source, self-hostable personal subscription tracker. Visualize your recurring expenses, manage your budget, and save money.