Wallos, an open‑source personal subscription tracker, has a server‑side request forgery flaw in its notification testing feature. An unauthenticated or authenticated attacker who can trigger the tester can make the server send HTTP requests to arbitrary URLs, potentially accessing internal resources, leaking data, or pivoting to other systems. The weakness corresponds to CWE‑918 and CWE‑295, indicating path traversal and insecure communication protocols.

All users running ellite's Wallos before version 4.6.2 are affected. The vulnerability applies to the open‑source Wallos application, all platforms supported by the product, and affects any installation where the notification tester endpoint is reachable. Users on later releases, notably 4.6.2 and newer, have received the fix.

CVSS score 8.8 points to high impact; however, EPSS suggests the probability of real‑world exploitation is very low (<1%), and the vulnerability has not been listed in CISA's KEV catalog. The likely attack vector is remote, driven by sending crafted requests to the notification tester API. No authentication is required to trigger the flaw, meaning any tip‑to‑tap can serve as an initial foothold. The impact includes unauthorized data access, credential theft, or as a pivot for further lateral movement.