What is the CVSS score of EUVD-2026-28385?

EUVD-2026-28385 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Wallos EUVD-2026-28385

| CVE-2026-41689 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-07 GitHub_M

Authentication Bypass Wallos

6.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.0 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 15:01 vuln.today

CVE Published

May 07, 2026 - 13:53 nvd

MEDIUM 6.0

DescriptionGitHub Advisory

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notification feature reuses an administrator-configured local-target allowlist for every logged-in user. Any normal user can fully control a webhook URL, headers, and body, then use Wallos to send server-side requests to allowlisted internal automation services. When such a target exposes deployment or execution APIs, this can further enable adjacent-service RCE, but that downstream result is conditional on the target service. At time of publication, there are no publicly available patches.

AnalysisAI

Wallos versions 4.8.4 and prior allow authenticated users to bypass webhook URL restrictions and send server-side requests to administrator-allowlisted internal targets by reusing the global allowlist for individual user webhooks. This enables Server-Side Request Forgery (SSRF) to internal automation services that may expose deployment or execution APIs, potentially leading to remote code execution on downstream systems. No public exploit code identified at time of analysis, and no vendor-released patch is available.

Technical ContextAI

Wallos implements a webhook notification system that maintains an administrator-configured allowlist of internal target URLs for security purposes. The vulnerability stems from CWE-863 (Incorrect Authorization) - the application fails to enforce per-user or per-webhook authorization checks and instead trusts a single global allowlist across all authenticated users. Any logged-in user can specify arbitrary webhook destinations, headers, and body content, then trigger Wallos to execute server-side HTTP requests to allowlisted addresses. The affected product is the Ellite Wallos open-source subscription tracker (CPE: cpe:2.3:a:ellite:wallos:*:*:*:*:*:*:*:*), affecting versions 4.8.4 and earlier. This is a classic SSRF pattern where the application acts as a pivot point to access internal services that are not directly accessible from the attacker's network position.

RemediationAI

No vendor-released patch has been identified at the time of analysis. Organizations should implement the following compensating controls: (1) Restrict webhook functionality to administrator-only users by implementing role-based access control (RBAC) in Wallos, preventing normal users from creating or modifying webhooks - this is the most effective mitigation but requires code modification or upstream fix; (2) Implement network segmentation by restricting Wallos server outbound connectivity to only necessary external services and blocking internal automation service access at the firewall level - this prevents SSRF but may limit legitimate webhook use cases; (3) Disable the webhook notification feature entirely in Wallos configuration if not actively used, eliminating the attack surface at the cost of losing webhook functionality; (4) Audit and minimize the administrator-configured allowlist to only essential, read-only internal services that do not expose execution APIs, reducing downstream RCE risk. Monitor the GitHub advisory (https://github.com/ellite/Wallos/security/advisories/GHSA-jx6w-832g-42wv) for upstream patch releases. If a patched version becomes available, upgrade immediately to the fixed release.