CVE-2026-33399

HIGH

Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840

Title source: cna

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE-2026-30840 is incomplete. The validate_webhook_url_for_ssrf() protection was added to the test* notification endpoints but not to the corresponding save* endpoints. An authenticated user can save an internal/private IP address as a notification URL, and when the cron job sendnotifications.php executes, the request is sent to the internal IP without any SSRF validation. This issue has been patched in version 4.7.0.

References (2)

[X_Refsource_Confirm] https://github.com/ellite/Wallos/security/advisories/GHSA-mfjc-3258-cq3j

[X_Refsource_Misc] https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef#diff-d77202c5d47a3d7d4586e519f6f5e256da5fb2969fa8b9c75c399b2821e9de40

View Writeup ZIP pw:eip

Scores

CVSS v3 7.7

EPSS 0.0004

EPSS Percentile 11.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (2)

ellite/Wallos < 4.7.0

wallosapp/wallos < 4.7.0

Published Mar 24, 2026

Tracked Since Mar 24, 2026