anonhaven
Ad

CVE-2026-30840

HIGH CVSS 3.0: 8.8 EPSS 0.05%
Updated Mar 07, 2026
Wallos
Parameter Value
CVSS 8.8 (HIGH)
Fixed In 4.6.2
Type CWE-918 (Server-Side Request Forgery (SSRF)), CWE-295 (Improper Certificate Validation)
Vendor Wallos
Public PoC No

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, there is a server-side request forgery vulnerability in notification testers. This issue has been patched in version 4.6.2.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v3.0

Weakness Type (CWE)

CWE-918 Server-Side Request Forgery (SSRF)
CWE-295 Improper Certificate Validation

References 3

https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d
security-advisories@github.com
https://github.com/ellite/Wallos/releases/tag/v4.6.2
security-advisories@github.com
https://github.com/ellite/Wallos/security/advisories/GHSA-mr2c-prqv-hqm8
security-advisories@github.com
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-33417

Wallos

7.1

CVE-2026-33401

Wallos

7.1

CVE-2026-33400

Wallos

5.4

CVE-2026-30842

Wallos

4.3

CVE-2026-30828

Wallos

8.7