CVE-2026-41689

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notification feature reuses an administrator-configured local-target allowlist for every logged-in user. Any normal user can fully control a webhook URL, headers, and body, then use Wallos to send server-side requests to allowlisted internal automation services. When such a target exposes deployment or execution APIs, this can further enable adjacent-service RCE, but that downstream result is conditional on the target service. At time of publication, there are no publicly available patches.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-863CWE-918

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-41692.4A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xCVE-2026-416908.618next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3CVE-2026-416919.1Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a sCVE-2026-416924.7i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4CVE-2026-416938.2i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Prior to version 2CVE-2026-416945.3Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid CVE-2026-416957.5Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path sCVE-2026-416965.9Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bCVE-2026-416974.8Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, orCVE-2026-416999.8Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a CVE-2026-41709.8A weakness has been identified in Topsec TopACM 3.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfCVE-2026-417008.1Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can