CVE-2026-33399: Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE-2026-30840 is incomplete. The validatewebhookurlforssrf() protection was added to the test notification endpoints but not to the corresponding save endpoints. An authenticated user can save an internal/private IP address as a notification URL, and when the cron job sendnotifications.php executes, the request is sent to the internal IP without any SSRF validation. This issue has been patched in version 4.7.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33399?
The severity of CVE-2026-33399 is classified as high due to its potential for SSRF attacks.
How do I fix CVE-2026-33399?
To fix CVE-2026-33399, upgrade Wallos to version 4.7.0 or later.
What is the cause of CVE-2026-33399?
CVE-2026-33399 is caused by an incomplete fix for SSRF vulnerabilities present in earlier versions of Wallos.
Which versions of Wallos are affected by CVE-2026-33399?
Wallos versions prior to 4.7.0 are affected by CVE-2026-33399.
Is CVE-2026-33399 related to any previous vulnerabilities?
Yes, CVE-2026-33399 is related to CVE-2026-30839 and CVE-2026-30840, which were earlier SSRF vulnerabilities.