PT-2026-38446 · Ellite · Wallos

Published 2026-05-07 · Updated 2026-05-07 · CVE-2026-41689

NVD

CVSS v3.1

6.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notification feature reuses an administrator-configured local-target allowlist for every logged-in user. Any normal user can fully control a webhook URL, headers, and body, then use Wallos to send server-side requests to allowlisted internal automation services. When such a target exposes deployment or execution APIs, this can further enable adjacent-service RCE, but that downstream result is conditional on the target service. At time of publication, there are no publicly available patches.

Exploit

Fix

SSRF

Incorrect Authorization

Weakness Enumeration

CWE-918

CWE-863

Related Identifiers

CVE-2026-41689

Affected Products

Wallos

References · 2

• 🔥 https://github.com/ellite/Wallos/security/advisories/GHSA-jx6w-832g-42wv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41689 · Security Note