CVE-2026-30839: Wallos: SSRF via webhook test endpoint
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in version 4.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 4.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30839?
CVE-2026-30839 has a high severity due to its potential for full-read Server-Side Request Forgery (SSRF) attacks.
How do I fix CVE-2026-30839?
To fix CVE-2026-30839, upgrade Wallos to version 4.6.2 or later where the vulnerability has been addressed.
What software is affected by CVE-2026-30839?
CVE-2026-30839 affects Wallos versions prior to 4.6.2.
What is the impact of CVE-2026-30839 exploit?
Exploiting CVE-2026-30839 can allow an attacker to make unauthorized requests to internal services by exploiting the SSRF vulnerability.
Is there a workaround for CVE-2026-30839 if upgrading is not possible?
A possible workaround for CVE-2026-30839 is to restrict access to the server running Wallos to limit exposure to SSRF attacks.