CVE-2026-77351

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to whatever address the attacker specified. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3
https://github.com/ellite/Wallos/releases/tag/v5.0.0
https://github.com/ellite/Wallos/security/advisories/GHSA-mwqv-gv8x-9jcp

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-31 22:17

Updated : 2026-09-08 21:11

NVD link : CVE-2026-77351

Mitre link : CVE-2026-77351

CVE.ORG link : CVE-2026-77351

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-77351", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77351", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T13:23:39.293752Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ellite", "product": "Wallos", "versions": [{"status": "affected", "version": "< 5.0.0"}]}]}], "published": "2026-08-31T22:17:20.467", "references": [{"url": "https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3", "source": "security-advisories@github.com"}, {"url": "https://github.com/ellite/Wallos/releases/tag/v5.0.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/ellite/Wallos/security/advisories/GHSA-mwqv-gv8x-9jcp", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host \u2014 including private and cloud-metadata IP addresses \u2014 in their personal email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to whatever address the attacker specified. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0."}], "lastModified": "2026-09-08T21:11:31.703", "sourceIdentifier": "security-advisories@github.com"}