Wallos CVE-2026-77352

Exploitation requires a valid authenticated Wallos user account; administrative privileges are not needed and no special role or permission beyond basic login is required. The SSRF connection is triggered asynchronously by the notification cron job (sendnotifications.php), not immediately on saving the SMTP setting - the attacker must have at least one subscription with an upcoming notification event to trigger the connection, or wait for the cron schedule to fire. Wallos instances with open user registration (a configurable admin setting) are particularly at risk because any external actor can self-register and immediately exploit this. The internal hosts probed must be network-reachable from the Wallos server itself, so the impact depends on the server's network placement. Exploitation is limited to outbound TCP connection initiation (SSRF) and does not provide direct read access to Wallos application data.

The CVSS 4.3 Medium score reflects a network-reachable, low-complexity path that requires only a standard user account. The SSRF is blind or semi-blind - the attacker receives no direct HTTP response, but the TCP connection itself reveals whether an internal host and port are reachable, enabling internal network enumeration and potential interaction with SMTP-speaking services (e.g., internal mail relays, Redis, Memcached if they respond to SMTP-like banners). Instances with open registration face a broader threat surface since any self-registered account can exploit this. No EPSS probability was provided in the input and cannot be quantified; there is no CISA KEV listing and no known public POC, suggesting this has not seen widespread opportunistic exploitation. The practical severity is most acute in deployments where the Wallos container shares a network segment with sensitive internal services - organizations should evaluate their network topology before deprioritizing based on the medium CVSS alone.

An attacker with any valid Wallos account (including self-registered if registrations are open) navigates to personal notification settings, sets the SMTP host field to an internal IP such as 10.0.0.5 and port 6379 (Redis), and saves the configuration. When the next notification cron execution fires for any of that user's subscriptions, the Wallos server initiates a TCP connection to 10.0.0.5:6379 - allowing the attacker to confirm the service is reachable and potentially exchange protocol banners. No public POC has been identified, but the exploit path is straightforward given the direct code flow documented in the advisory.