CVE-2026-77351

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to whatever address the attacker specified. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.

• CWE-918

• https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3
• https://github.com/ellite/Wallos/releases/tag/v5.0.0
• https://github.com/ellite/Wallos/security/advisories/GHSA-mwqv-gv8x-9jcp

Published

Aug 31, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77337CakePHP Authentication is an authentication plugin for CakeP…9.1
• CVE-2026-77339Process Compose is a scheduler and orchestrator for non-cont…5.1
• CVE-2026-7734A vulnerability has been found in osrg GoBGP up to 4.3.0. Th…7.5
• CVE-2026-77341cpp-httplib is a C++ header-only HTTP/HTTPS library. In vers…5.3
• CVE-2026-77348Wallos is an open-source, self-hostable personal subscriptio…8.2
• CVE-2026-7735A vulnerability was found in osrg GoBGP up to 4.3.0. Affecte…7.3
• CVE-2026-77352Wallos is an open-source, self-hostable personal subscriptio…4.3
• CVE-2026-77353Wallos is an open-source, self-hostable personal subscriptio…4.6
• CVE-2026-77354kin-openapi is a Go project for handling OpenAPI files. From…8.7
• CVE-2026-77357Mesop is a Python-based UI framework that allows users to bu…8.7
• CVE-2026-77358cpp-httplib is a C++ header-only HTTP/HTTPS library. In vers…8.2
• CVE-2026-7736A vulnerability was determined in osrg GoBGP up to 4.3.0. Af…7.5