The flaw permits any authenticated, non‑administrative user to craft arbitrary webhook requests that are executed by the Wallos server, targeting any service listed in the shared local‑target allowlist. Because the allowlist is common to all users, a normal account can issue requests to internal endpoints that expose management or execution functionality. If such a downstream service provides deployment or command execution APIs, the attacker’s crafted webhook can trigger those APIs, potentially leading to remote code execution on the internal host. The vulnerability is a classic server‑side request forgery (CWE‑918) combined with a privilege‑level mis‑configuration (CWE‑863).

Wallos versions 4.8.4 and earlier, provided by the vendor ellite. The product is an open‑source subscription‑tracking application; no other specific product lines are affected.

The CVSS score of 6 indicates medium severity. No EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need only a regular user account. The exploitation path is straightforward: select a webhook target from the allowlist, configure arbitrary headers, body and URL, and send the request. Successful exploitation requires that the target internal service have vulnerable APIs; otherwise the impact is limited to unauthorized information disclosure or manipulation within the service.