CVE-2026-77352

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin rights required) can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of their personal email notifications to an internal IP. The per-user notification settings endpoint (endpoints/notifications/saveemailnotifications.php) performs no SSRF validation, and the notification cron (endpoints/cronjobs/sendnotifications.php) feeds that user-controlled host straight into PHPMailer ($mail->Host = $email['smtpAddress']). When the user's subscription notification fires, the server connects to the chosen host:port. This issue has been patched in version 5.0.0.

• CWE-918

• https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3
• https://github.com/ellite/Wallos/releases/tag/v5.0.0
• https://github.com/ellite/Wallos/security/advisories/GHSA-c75x-9vj6-57qj

Published

Aug 31, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77339Process Compose is a scheduler and orchestrator for non-cont…5.1
• CVE-2026-7734A vulnerability has been found in osrg GoBGP up to 4.3.0. Th…7.5
• CVE-2026-77341cpp-httplib is a C++ header-only HTTP/HTTPS library. In vers…5.3
• CVE-2026-77348Wallos is an open-source, self-hostable personal subscriptio…8.2
• CVE-2026-7735A vulnerability was found in osrg GoBGP up to 4.3.0. Affecte…7.3
• CVE-2026-77351Wallos is an open-source, self-hostable personal subscriptio…3.5
• CVE-2026-77353Wallos is an open-source, self-hostable personal subscriptio…4.6
• CVE-2026-77354kin-openapi is a Go project for handling OpenAPI files. From…8.7
• CVE-2026-77357Mesop is a Python-based UI framework that allows users to bu…8.7
• CVE-2026-77358cpp-httplib is a C++ header-only HTTP/HTTPS library. In vers…8.2
• CVE-2026-7736A vulnerability was determined in osrg GoBGP up to 4.3.0. Af…7.5
• CVE-2026-77360oRPC is an tool that helps build APIs that are end-to-end ty…6.3