---
id: CVE-2026-77352
title: 'Wallos is an open-source, self-hostable personal subscription tracker'
summary: >-
  Wallos is an open-source, self-hostable personal subscription tracker. From
  version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin
  rights required) can make the server open arbitrary outbound SMTP connections
  to i…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-918
published: '2026-08-31'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:11:31.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77352'
references:
  - url: >-
      https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/releases/tag/v5.0.0'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-c75x-9vj6-57qj'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00193
epssPercentile: 0.09235
ingestedAt: '2026-09-08T22:12:30.945Z'
---

## Overview

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin rights required) can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of their personal email notifications to an internal IP. The per-user notification settings endpoint (endpoints/notifications/saveemailnotifications.php) performs no SSRF validation, and the notification cron (endpoints/cronjobs/sendnotifications.php) feeds that user-controlled host straight into PHPMailer ($mail->Host = $email['smtpAddress']). When the user's subscription notification fires, the server connects to the chosen host:port. This issue has been patched in version 5.0.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.