Wallabag Holds More Than Saved Pages
Wallabag stores articles, account details, API clients, and optional paywall credentials. An internet-facing reader can be a small service with a meaningful data set: saved pages may include internal documents, research notes, or links that reveal organizational interests.
Query result
On 2026-10-30, ZoomEye count-only queries used sub_type=all, page 1, and page size 1. app="Wallabag" returned 0. title="Wallabag" returned 1,544.
The app query did not match the selected fingerprint. The title result is a separate observation and may include login pages and other branded pages. It does not prove that any instance has sharing enabled or that a user's saved content is public.
Account and sharing controls
Wallabag's user documentation describes two-factor authentication and notes that administrators must enable the feature in the configuration before users can activate it. This is an application-level prerequisite. An organization that assumes every user has MFA should verify the instance setting and the per-user enrollment state.
The internal settings documentation describes privacy-related controls, including public sharing of articles. Review who can enable sharing and how a shared page can be revoked. Test with a disposable article and an unauthenticated browser. Confirm that a later revocation removes access, including from a cached direct URL where the application supports it.
Paywall credentials are especially sensitive. Wallabag's restricted-access documentation describes optional credentials for sites that require authentication. That credential store should not be readable by every user or by a database backup process with broader access than necessary. Rotate a test credential and confirm that the old value fails.
API clients
The user interface includes a place to manage API clients used by mobile apps and integrations. Each client should map to a known user and have a revocation path. A token saved in a phone backup or a browser extension is still part of the account boundary.
Review old clients after a device change. Remove a client that no longer has an owner. Test an API request after revocation. Keep OAuth access-token lifetime in mind when investigating a report of continued access. An issue dated after a token was issued does not automatically mean the old token was still valid at that time; the server logs need to show the actual session.
Network and backup checks
Find the public hostname and any alternate port or internal alias. The main login page may be protected by a proxy while the API route bypasses it. Test both with and without the expected session.
Check backup storage. Wallabag can use SQLite or another database, and the installation documentation describes database configuration parameters. The backup should be protected by the same access policy as the live data, including encryption and retention. A public title match can identify a possible instance; it cannot reveal whether an old backup sits beside it.
A focused review
Record the owned instances, version, MFA setting, sharing policy, API clients, and paywall credential ownership. Then test one legitimate share, one revoked share, one disabled user, and one revoked token. The result should show which controls fail closed and which rely on an operator remembering to change a setting.
The count is only an inventory clue. The security work is the smaller set of tests that connect a saved page to the person who should still be able to read it.
Top comments (0)