CVE-2026-33399 - Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840

Back Back to CVE browser

HIGH

Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840

Published Mar 24, 2026

7.7

HIGH

CVSS 3.1

EPSS 0.40%

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE-2026-30840 is incomplete. The validate_webhook_url_for_ssrf() protection was added to the test* notification endpoints but not to the corresponding save* endpoints. An authenticated user can save an internal/private IP address as a notification URL, and when the cron job sendnotifications.php executes, the request is sent to the internal IP without any SSRF validation. This issue has been patched in version 4.7.0.

Affected products

Vendor Ellite Product Wallos Default
n/a
- Version
  < 4.7.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ellite

Wallos

n/a

Version	Status	Constraints
< 4.7.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14945
Advisory
https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef#diff-d77202c5d47a3d7d4586e519f6f5e256da5fb2969fa8b9c75c399b2821e9de40
x_refsource_MISCPatch
https://github.com/ellite/Wallos/security/advisories/GHSA-mfjc-3258-cq3j
x_refsource_CONFIRMExploitVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14945		Advisory
https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef#diff-d77202c5d47a3d7d4586e519f6f5e256da5fb2969fa8b9c75c399b2821e9de40		x_refsource_MISCPatch
https://github.com/ellite/Wallos/security/advisories/GHSA-mfjc-3258-cq3j		x_refsource_CONFIRMExploitVendor Advisory