CVE-2026-41689

Katalog CVE

CVSS 6.0 · Medium EPSS 0,27%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 6.0 (Medium) menurut github.com.

Deskripsi (NVD)

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notification feature reuses an administrator-configured local-target allowlist for every logged-in user. Any normal user can fully control a webhook URL, headers, and body, then use Wallos to send server-side requests to allowlisted internal automation services. When such a target exposes deployment or execution APIs, this can further enable adjacent-service RCE, but that downstream result is conditional on the target service. At time of publication, there are no publicly available patches.

Rincian

Terbit di NVD

7 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.0 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/ellite/Wallos/security/advisories/GHSA-jx6w-832g-42wv