Wallos CVE-2026-61638

Exploitation requires a valid authenticated session on the target Wallos instance - any registered user account suffices, administrator privileges are not required. The vulnerable endpoint is POST /endpoints/notifications/testemailnotifications.php and is present in the default Wallos installation prior to v4.9.6; no special feature flag or non-default configuration is needed. Exploitation is constrained by: (1) the requirement for at least one authenticated account, ruling out unauthenticated opportunistic scanning; (2) the read-only nature of the SSRF (confidentiality impact only, no arbitrary code execution on the server); and (3) the practical value of reachable targets - cloud-hosted instances with unprotected IMDS access represent the highest-risk deployments. Instances with egress filtering blocking RFC-1918 and link-local (169.254.0.0/16) address ranges are substantially protected against metadata API access.

The supplied CVSS 4.0 score of 8.2 with PR:N (no privileges required) directly conflicts with the CVE description, which states 'any authenticated user' - the correct metric should be PR:L, which would lower the effective score and materially change the risk profile. The AT:P (attack prerequisites present) annotation in the supplied vector partially signals a constraint but leaves it undefined. No EPSS data is available and the vulnerability is absent from CISA KEV, indicating no confirmed widespread exploitation. Practical severity is highly deployment-context dependent: a Wallos instance running in a cloud environment with access to IMDS endpoints (e.g., AWS IMDSv1 at 169.254.169.254) represents a meaningful lateral movement path to cloud IAM credentials, while an isolated homelab deployment exposes only whatever internal services are reachable from the host. The v4.9.6 release bundles multiple security fixes - SSRF via email and OIDC, account takeover, OIDC state hardening, and a zip-slip vulnerability - suggesting a broader security audit was conducted; defenders should treat any pre-4.9.6 installation as carrying multiple concurrent weaknesses beyond this SSRF alone.

An authenticated Wallos user sends a crafted POST request to /endpoints/notifications/testemailnotifications.php with smtpaddress set to 169.254.169.254 and smtpport to 80, causing the server to open a TCP connection to the AWS EC2 instance metadata service. The attacker infers service availability and metadata content from response timing or error messages, potentially retrieving IAM role credentials attached to the host instance. No public proof-of-concept code has been identified at time of analysis, but the endpoint is reachable with any authenticated HTTP session and standard tooling.