Read the docs
TI-2026-53973 Aliases CVE-2026-77351

Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings

Priority MEDIUM 50CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to whatever address the attacker specified. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Fix Fixed Wallos (ellite): 5.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elliteWallosbefore 5.0.05.0.0Patch availableCNA
  • Wallos Vendorellite Affected before 5.0.0 Fixed in 5.0.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:*——ellite
  • cpe:2.3:a:wallosapp:wallos:*:*:*:*:*:*:*:* Versions — — ·ellite

Remediation

  • Fix · CNA Wallos (ellite) Fixed in 5.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77351

References

Other 3

  • TI-2026-53972 Server-side request forgery in ellite Wallos CVSS 3.1HIGH 8.2
  • TI-2026-39433 Wallos: Unauthenticated database replacement via import endpoint on fresh install CVSS 4.0HIGH 8.2
  • TI-2026-25804 Wallos: SSRF via HTTP Proxy Environment Variable CVSS 4.0HIGH 8.3
  • TI-2026-23669 Wallos: Server-Side Request Forgery (SSRF) in Notification Testers CVSS 3.0HIGH 8.8
  • TI-2026-39431 Missing Authentication for Critical Function in wallos CVSS 3.1HIGH 7.5
  • TI-2026-39432 Wallos: OIDC state parameter never validated — login CSRF / account takeover CVSS 4.0HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences