CVE-2026-30840 - Vulnerability Analysis

Overview

Wallos < 4.6.2 contains a server-side request forgery caused by improper validation in notification testers, letting attackers make arbitrary server requests, exploit requires network access.

Severity & Score

Impact

Attackers can make arbitrary server requests, potentially accessing internal resources or sensitive data.

Mitigation

Update to version 4.6.2 or later.

References

• https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d
• https://github.com/ellite/Wallos/releases/tag/v4.6.2
• https://github.com/ellite/Wallos/security/advisories/GHSA-mr2c-prqv-hqm8

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 24, 2026

🟠 CVE-2026-33399 - High (7.7) Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE-2026-30840 is incomplete. The validate_webhook_url_for_ssrf() protection was added to t... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33399/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner