Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111661waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint

Medium 5.3

In plain English

A medium-severity missing authentication in waynboot-mall from wayn111. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 70.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.

Affected products (as reported)

Vendor	Product	Versions
wayn111	waynboot-mall	0 – through 2.0.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://hackmd.io/@hieuPenguinnn/waynboot-mall-unauth-callback-order-forgery-cancel-mail-relay third-party-advisory
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/api/controller/callback/EmailController.java#L32-L42 technical-description
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/framework/config/SecurityConfig.java#L66 technical-description
VulnCheck Advisory: waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint third-party-advisory