CVE-2026-77348

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.

• CWE-441
• CWE-918
• CWE-1188

• https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3
• https://github.com/ellite/Wallos/releases/tag/v5.0.0
• https://github.com/ellite/Wallos/security/advisories/GHSA-f8j2-qm83-r2w4
• https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc
• https://github.com/ellite/Wallos/security/advisories/GHSA-f8j2-qm83-r2w4
• https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc

Published

Aug 31, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77322SIPGO is a library for writing SIP services in the GO langua…7.5
• CVE-2026-7733A flaw has been found in funadmin up to 7.1.0-rc6. This affe…7.3
• CVE-2026-77337CakePHP Authentication is an authentication plugin for CakeP…9.1
• CVE-2026-77339Process Compose is a scheduler and orchestrator for non-cont…5.1
• CVE-2026-7734A vulnerability has been found in osrg GoBGP up to 4.3.0. Th…7.5
• CVE-2026-77341cpp-httplib is a C++ header-only HTTP/HTTPS library. In vers…5.3
• CVE-2026-7735A vulnerability was found in osrg GoBGP up to 4.3.0. Affecte…7.3
• CVE-2026-77351Wallos is an open-source, self-hostable personal subscriptio…3.5
• CVE-2026-77352Wallos is an open-source, self-hostable personal subscriptio…4.3
• CVE-2026-77353Wallos is an open-source, self-hostable personal subscriptio…4.6
• CVE-2026-77354kin-openapi is a Go project for handling OpenAPI files. From…8.7
• CVE-2026-77357Mesop is a Python-based UI framework that allows users to bu…8.7