# CVE-2026-77351: Wallos SSRF in email notification settings

Source: https://junglewise.ai/threats/cve-2026-77351-wallos-ssrf-in-email-notification-settings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77351 · Severity: low · CVSS 3.5 · Published 2026-08-31

Wallos is an open-source subscription tracker that allows users to manage recurring payments and send email notifications. Prior to version 5.0.0, any authenticated user could configure an arbitrary SMTP server address—including internal network IPs or cloud metadata endpoints—in their email settings. When Wallos sends notifications, it connects to the attacker-specified address, enabling them to probe internal services and potentially access sensitive cloud metadata, without requiring any special privileges.

## Quick answers

**Is CVE-2026-77351 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77351 being exploited in the wild.

**How severe is CVE-2026-77351?** Low severity, with a CVSS score of 3.5, published 31 August 2026.

**Which products and versions are affected?** Wallos Wallos before 5.0.0.

**Is there a fix for CVE-2026-77351?** A patch was published on 2026-07-11: Fixed in version 5.0.0 with SMTP host validation Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77351 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77351?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Server-Side Request Forgery (SSRF) vulnerability in the email notification feature. The vulnerable component is the SMTP configuration in user email notification settings, which accepted and stored arbitrary hostnames without server-side validation. When the scheduled notification cron job executes, it passes the stored SMTP host directly to PHPMailer, causing the Wallos server to open outbound TCP connections to attacker-controlled addresses. An authenticated user (any user with an account) can exploit this with no additional preconditions to probe internal network services, including private IP ranges and cloud metadata endpoints, from the server's network perspective. The vulnerability has been patched in version 5.0.0 with SMTP host validation against SSRF.

## Affected products

- Wallos Wallos before 5.0.0

## Timeline

- 2026-07-11: patched: Fixed in version 5.0.0 with SMTP host validation
- 2026-08-31: disclosed

## References

- [https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3](https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3)
- [https://github.com/ellite/Wallos/releases/tag/v5.0.0](https://github.com/ellite/Wallos/releases/tag/v5.0.0)