CVE-2026-77352: Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)
Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin rights required) can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of their personal email notifications to an internal IP. The per-user notification settings endpoint (endpoints/notifications/saveemailnotifications.php) performs no SSRF validation, and the notification cron (endpoints/cronjobs/sendnotifications.php) feeds that user-controlled host straight into PHPMailer ($mail->Host = $email['smtpAddress']). When the user's subscription notification fires, the server connects to the chosen host:port. This issue has been patched in version 5.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
Which deployments are affected?
Wallos versions 2.0.0 through versions before 5.0.0 are affected. Version 5.0.0 contains the patch.
What access does an attacker need to trigger the server-side connection?
An attacker needs an authenticated Wallos account; administrator privileges are not required. They can configure their own email-notification SMTP host to an internal or link-local address, and the connection occurs when one of their subscription notifications fires.
What can an attacker do with this issue?
The attacker can cause the Wallos server to initiate outbound SMTP connections to an attacker-selected host and port, including internal or link-local addresses. The provided information describes connection capability and does not establish access to response data or the ability to alter data.
How can I determine whether an instance is exposed?
Check whether the instance runs a version earlier than 5.0.0 and allows authenticated users to configure personal SMTP settings for email notifications. Review those settings and outbound connection logs for SMTP destinations using internal or link-local IP addresses.