Read the docs
TI-2026-25798 Aliases CVE-2026-33401

Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php

Priority MEDIUM 64CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the patch introduced in commit e8a513591 (CVE-2026-30840) added SSRF protection to notification test endpoints but left three additional attack surfaces unprotected: the AI Ollama host parameter, the AI recommendations endpoint, and the notification cron job. An authenticated user can reach internal network services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure IMDS), or localhost-bound services by supplying a crafted URL to any of these endpoints. This issue has been patched in version 4.7.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00294 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Wallos (ellite): 4.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elliteWallosbefore 4.7.04.7.0Patch availableCNA
  • Wallos Vendorellite Affected before 4.7.0 Fixed in 4.7.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*before 4.7.0Vulnerableellite
  • cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:* Versions before 4.7.0 Vulnerable ·ellite

Remediation

  • Fix · CNA Wallos (ellite) Fixed in 4.7.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33401

References

Exploit 1

Patch 2

  • TI-2026-25804 Wallos: SSRF via HTTP Proxy Environment Variable CVSS 4.0HIGH 8.3
  • TI-2026-23669 Wallos: Server-Side Request Forgery (SSRF) in Notification Testers CVSS 3.0HIGH 8.8
  • TI-2024-19429 Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. CVSS 3.1HIGH 8.1
  • TI-2026-25796 Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840 CVSS 3.1HIGH 7.7
  • TI-2026-21886 Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch CVSS 3.1HIGH 7.7
  • TI-2026-25814 Wallos: Password Reset Tokens Never Expire CVSS 3.1HIGH 7.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences