CVE-2026-77352

Received Received - Intake

Authenticated SMTP SSRF in Wallos Self-Hosted Subscription Tracker

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin rights required) can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of their personal email notifications to an internal IP. The per-user notification settings endpoint (endpoints/notifications/saveemailnotifications.php) performs no SSRF validation, and the notification cron (endpoints/cronjobs/sendnotifications.php) feeds that user-controlled host straight into PHPMailer ($mail->Host = $email['smtpAddress']). When the user's subscription notification fires, the server connects to the chosen host:port. This issue has been patched in version 5.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-77352

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	wallos	From 2.0.0 (inc) to 5.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Wallos is a self-hosted subscription tracker. A flaw in versions 2.0.0 to 4.x allows authenticated users to set their email notification SMTP host to internal or link-local IP addresses. The server then connects to these addresses without proper validation, enabling potential internal network access.

Detection Guidance

Check Wallos logs for outbound SMTP connections to internal or link-local IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16). Review user notification settings for suspicious SMTP host configurations.

Impact Analysis

An attacker with a Wallos account could exploit this to probe internal networks, access sensitive services, or exfiltrate data from internal systems. This could lead to unauthorized information disclosure or network reconnaissance.

Compliance Impact

This vulnerability may violate data protection requirements under GDPR and HIPAA by enabling unauthorized network access and potential data breaches. Organizations using affected versions could face compliance violations and regulatory penalties.

Mitigation Strategies

Upgrade Wallos to version 5.0.0 or later to patch the SSRF vulnerability. If upgrading is not immediately possible, restrict outbound SMTP connections to trusted external IPs via firewall rules.

Hi! I’m here to help you understand CVE-2026-77352. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70