Improper SSRF Protection in Wallos Subscription Tracker by ellite
CVE-2026-33399

7.7HIGH

Key Information:

Vendor

Ellite

Status
Wallos
Vendor
CVE Published:
24 March 2026

What is CVE-2026-33399?

Wallos is an open-source personal subscription tracker that has a vulnerability related to Server-Side Request Forgery (SSRF). In versions prior to 4.7.0, the protection intended to guard against SSRF attacks was inadequately implemented. Although the validate_webhook_url_for_ssrf() function was added to certain notification endpoints in version 4.6.2, it was not extended to the save* endpoints. This oversight permits an authenticated user to register an internal or private IP address as a notification URL. When the scheduled task sendnotifications.php is triggered, requests may be improperly directed to this internal IP address without the necessary SSRF validation, potentially exposing sensitive internal resources. Users are advised to upgrade to version 4.7.0 or later to remedy this security flaw.

Affected Version(s)

Wallos < 4.7.0

References

https://github.com/ellite/Wallos/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/ellite/Wallos/commit/e87387f0ebb540cd3...
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.