CVE-2026-61638

Wallos, an open-source, self-hostable personal subscription tracker, contains a server-side request forgery flaw (CWE-918) in its test-email notification endpoint, POST /endpoints/notifications/testemailnotifications.php. The endpoint accepts smtpaddress and smtpport directly from the POST body with no SSRF validation — unlike every other notification endpoint, which validates through ssrf_helper.php — so PHPMailer connects to whatever attacker-supplied host:port is submitted. Any authenticated Wallos user can abuse this to make the server probe internal network services and cloud metadata endpoints and observe the responses, which is why the flaw is rated high severity (CVSS 4.0: 8.2) with high confidentiality impact. All deployments running a version prior to 4.9.6 are affected, particularly self-hosted instances that are internet-exposed or shared among multiple users. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to Wallos 4.9.6 or later, prioritizing instances that are internet-exposed or allow multiple user accounts. Until patched, restrict access to the test-email endpoint and block outbound requests from the Wallos host or container to internal network ranges and the cloud metadata address (169.254.169.254). Operators running Wallos in cloud environments should check whether untrusted authenticated users could have reached the metadata service and consider rotating any metadata-issued credentials as a precaution.