---
id: CVE-2026-77351
title: 'Wallos is an open-source, self-hostable personal subscription tracker'
summary: >-
  Wallos is an open-source, self-hostable personal subscription tracker. Prior
  to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP
  host — including private and cloud-metadata IP addresses — in their personal
  email …
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N'
cwe:
  - CWE-918
published: '2026-08-31'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:11:31.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77351'
references:
  - url: >-
      https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/releases/tag/v5.0.0'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-mwqv-gv8x-9jcp'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.0029
epssPercentile: 0.19299
ingestedAt: '2026-09-08T22:12:30.945Z'
---

## Overview

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to whatever address the attacker specified. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.