CVE-2026-33399

CVE-2026-33399 is a High severity (CVSS 7.7) Server-Side Request Forgery (SSRF) vulnerability affecting Wallos, an open-source personal subscription tracker, prior to version 4.7.0. This flaw allows an authenticated attacker to bypass incomplete SSRF protections by saving an internal IP address as a notification URL, which is then accessed by a cron job without validation. This enables the attacker to make unvalidated requests to internal/private networks from the Wallos server, potentially leading to sensitive information disclosure. The attack requires low privileges and has low complexity. While no active exploitation or public exploit code has been identified, the vulnerability has received limited community discussion.