CVE-2026-41689

CVE-2026-41689 affects Wallos up to version 4.8.4. The webhook notification feature reuses an administrator-configured local-target allowlist for all logged-in users, allowing any normal user to fully control a webhook URL, headers, and body, then send server-side requests to allowlisted internal...