SSRF Vulnerability in Wallos Subscription Tracker by Ellite

CVE-2026-77352

What is CVE-2026-77352?

Wallos, an open-source personal subscription tracker, has a significant vulnerability allowing any authenticated user to manipulate the server's outbound SMTP connections. This is facilitated by the absence of proper SSRF validation on the notification settings endpoint, which permits users to set their SMTP host to an internal IP address. As a result, during subscription notifications, the server may establish connections to internal link-local addresses without the need for administrative rights. The vulnerability has been addressed in version 5.0.0 of Wallos, ensuring better security against unauthorized access.

References