Live › vulnerability › CVE-2026-111659
Go to dashboardWaynboot-mall through 2.0.0 exposes an internal /callback/order/submit message-queue callback without authentication. An unauthenticated attacker can submit orders for any member, reading stored shipping details, clearing carts and decrementing stock.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Waynboot-mall 2.0.0 or earlier where the order callback endpoint can be reached by untrusted clients. The sources do not say whether the endpoint is exposed by default in all deployments. Teams on a newer release, or with the callback path blocked from the internet, can likely skip it.
No product ranges from the sources yet.
2.0.0 or earlier./callback/order/submit is reachable from outside the internal network (unknown from sources).2.0.0 (fixed version unknown from sources)./callback/order/submit at the gateway or reverse proxy until patched.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.
This page as .md · .json · in your agent: get_signal("CVE-2026-111659")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.