CVE-2026-126778: Wallos 4.4.0 before 5.10.3 Stored XSS via sendnotifications.php
Wallos 4.4.0 before 5.10.3 contains a stored cross-site scripting vulnerability in endpoints/cronjobs/sendnotifications.php that allows registered users to inject scripts via unescaped notification service responses. Attackers can point their Mattermost webhook URL or Web Push endpoint at a controlled server returning JavaScript, which executes in the administrator's session when sendnotifications.php is opened.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any registered Wallos user who can configure a Mattermost webhook URL or Web Push endpoint can exploit it by directing that endpoint to an attacker-controlled server.
What must happen for the injected script to run?
The attacker-controlled notification service must return JavaScript, and an administrator must open endpoints/cronjobs/sendnotifications.php. The script then executes in the administrator's session.
Are deployments using default notification settings affected?
The provided information identifies exploitation through attacker-configured Mattermost webhook URLs or Web Push endpoints. It does not establish that default notification settings alone are affected.
What version contains the fix?
Wallos 5.10.3 contains the fix. Versions from 4.4.0 before 5.10.3 are affected.