CVE-2026-111661 — waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /call…
Published: 2026-10-16 · CVSS: 6.9 · CVSS 4.0
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7