CVE-2026-61638

Received Received - Intake

Server-Side Request Forgery in Wallos Subscription Tracker

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-61638

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	subscription_tracker	to 4.9.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Wallos before version 4.9.6 has a vulnerability in the email notification test endpoint. It allows authenticated users to supply SMTP server details without proper server-side request forgery validation. This lets attackers force the application to connect to arbitrary internal hosts or ports via PHPMailer.

Detection Guidance

This vulnerability allows authenticated users to probe internal networks via SSRF through the POST /endpoints/notifications/testemailnotifications.php endpoint. To detect exploitation attempts, monitor network traffic for outbound connections to unexpected SMTP servers or internal IP addresses originating from the Wallos application. Check application logs for POST requests to this specific endpoint with unusual smtpaddress or smtpport parameters.

Impact Analysis

An authenticated attacker could probe your internal network, scan for open ports, or access cloud metadata services. This could lead to information disclosure or further network compromise depending on what services are exposed.

Compliance Impact

This vulnerability could violate data protection requirements by allowing unauthorized network probing or access to sensitive internal systems. GDPR and HIPAA both require controls to prevent unauthorized network access and data breaches, which this flaw undermines.

Mitigation Strategies

Immediately upgrade Wallos to version 4.9.6 or later to patch this vulnerability. If immediate upgrade is not possible, restrict access to the /endpoints/notifications/testemailnotifications.php endpoint through network-level controls or application-level access restrictions. Review and audit all authenticated user accounts for suspicious activity.

Hi! I’m here to help you understand CVE-2026-61638. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70