CVE-2026-61638: CWE-918: Server-Side Request Forgery (SSRF) in ellite Wallos
Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.
CVSS v4.0
Score 8.2high
Affected software
ellite
Wallos
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Wallos versions before 4.9.6 contain an SSRF vulnerability in the testemailnotifications.php endpoint. This endpoint accepts smtpaddress and smtpport from the POST body without validating these inputs for SSRF. Unlike other notification endpoints that use ssrf_helper.php for SSRF protection, this email notification endpoint was missed. An authenticated user can exploit this to cause PHPMailer to connect to arbitrary hosts and ports, enabling internal network scanning or access to cloud metadata. The vulnerability has been fixed in version 4.9.6.
Potential Impact
An authenticated attacker can exploit this SSRF vulnerability to make the server connect to arbitrary internal or external hosts and ports. This can lead to internal network reconnaissance, access to cloud metadata services, or other unintended interactions with internal resources. The vulnerability does not require user interaction and has a high severity score of 8.2.
Mitigation Recommendations
This vulnerability has been patched in Wallos version 4.9.6. Users should upgrade to version 4.9.6 or later to remediate the issue. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-10T17:38:57.111Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a95e9aaacd9273b49934e53
Added to database: 08/31/2026, 20:52:58 UTC
Last enriched: 09/07/2026, 15:00:28 UTC
Last updated: 10/16/2026, 18:48:22 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.