# CVE-2026-77352: Wallos SSRF in SMTP host configuration

Source: https://junglewise.ai/threats/cve-2026-77352-wallos-ssrf-in-smtp-host-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77352 · Severity: medium · CVSS 4.3 · Published 2026-08-31

Wallos is an open-source personal subscription tracker that self-hosts on user servers. Any logged-in user can exploit a security gap to force the server to make outbound connections to internal or private IP addresses by manipulating email notification settings. This could enable attacks on internal services, database servers, or other sensitive infrastructure on the same network.

## Quick answers

**Is CVE-2026-77352 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77352 being exploited in the wild.

**How severe is CVE-2026-77352?** Medium severity, with a CVSS score of 4.3, published 31 August 2026.

**Which products and versions are affected?** Wallos Wallos 2.0.0 to before 5.0.0.

**Is there a fix for CVE-2026-77352?** A patch was published on 2026-07-11: Version 5.0.0 released with SSRF validation fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77352 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77352?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the per-user email notification settings endpoint (endpoints/notifications/saveemailnotifications.php) in Wallos versions 2.0.0 through 4.x. The endpoint accepts user-controlled SMTP host values without validation. When a subscription notification is triggered, the cron job (endpoints/cronjobs/sendnotifications.php) passes this host directly to PHPMailer's $mail->Host property, causing the server to initiate SMTP connections to arbitrary internal or link-local addresses. No administrator privileges are required—any authenticated user can exploit this. The vulnerability was patched in version 5.0.0 by adding SSRF validation to the SMTP host parameter.

## Affected products

- Wallos Wallos 2.0.0 to before 5.0.0

## Timeline

- 2026-08-31: disclosed
- 2026-07-11: patched: Version 5.0.0 released with SSRF validation fix

## References

- [https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3](https://github.com/ellite/Wallos/commit/11eaf402e841a628c68a805694227ce66c45f6f3)
- [https://github.com/ellite/Wallos/releases/tag/v5.0.0](https://github.com/ellite/Wallos/releases/tag/v5.0.0)