CVE-2026-77352

Name of the Vulnerable Software and Affected Versions Wallos versions 2.0.0 through 4.x

Description Authenticated users can force the server to establish arbitrary outbound SMTP connections to internal or link-local addresses. This occurs because the per-user notification settings endpoint 'endpoints/notifications/saveemailnotifications.php' lacks Server-Side Request Forgery (SSRF) validation—a flaw where an attacker induces the server to make requests to an unintended location. The notification cron 'endpoints/cronjobs/sendnotifications.php' then passes the user-controlled smtpAddress variable directly into the PHPMailer $mail->Host property. When a subscription notification is triggered, the server connects to the specified host and port.

Recommendations Update to version 5.0.0.