CVE-2026-30840

Published: Mar 7, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, there is a server-side request forgery vulnerability in notification testers. This issue has been patched in version 4.6.2.

Affected (1)

Products: Wallosapp: Wallos

Wallosapp

1 product

Wallos

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wallosapp Wallos	Before 4.6.2

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (3)

https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d

Source: security-advisories@github.com

Patch

https://github.com/ellite/Wallos/releases/tag/v4.6.2

Source: security-advisories@github.com

Release Notes

https://github.com/ellite/Wallos/security/advisories/GHSA-mr2c-prqv-hqm8

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

Timeline

No history available yet.