{"id":"CVE-2026-111659","kind":"vulnerability","aliases":["CVE-2026-111659"],"related":[],"title":"Waynboot-mall: unauthenticated callback forges orders and exposes shipping details","description":"Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.","summary":"Waynboot-mall through 2.0.0 exposes an internal /callback/order/submit message-queue callback without authentication. An unauthenticated attacker can submit orders for any member, reading stored shipping details, clearing carts and decrementing stock.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","java","package","self-hosted","waynboot-mall"],"not_affected_if":["callback-not-exposed","patched-release"],"how_to_check":"- Check whether the deployed Waynboot-mall version is `2.0.0` or earlier.\n- Check whether `/callback/order/submit` is reachable from outside the internal network (unknown from sources).","fix":"- Upgrade past `2.0.0` (fixed version unknown from sources).\n- Block external access to `/callback/order/submit` at the gateway or reverse proxy until patched.","status":"open","published_at":"2026-10-16T18:17:47+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:42:25+00:00","updated_at":"2026-10-25T03:42:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:42:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade past `2.0.0` (fixed version unknown from sources).\n- Block external access to `/callback/order/submit` at the gateway or reverse proxy until patched.","reach":"internet","title":"Waynboot-mall: unauthenticated callback forges orders and exposes shipping details","impact":"medium","summary":"Waynboot-mall through 2.0.0 exposes an internal /callback/order/submit message-queue callback without authentication. An unauthenticated attacker can submit orders for any member, reading stored shipping details, clearing carts and decrementing stock.","category":"package","nicknames":[],"who_cares":["waynboot-mall","self-hosted","java","ecommerce"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker forges orders, reads shipping details, and alters stock","analyst_note":"Find the patched version and default exposure of /callback/order/submit in the NVD entry or the project's repository.","how_to_check":"- Check whether the deployed Waynboot-mall version is `2.0.0` or earlier.\n- Check whether `/callback/order/submit` is reachable from outside the internal network (unknown from sources).","needs_analyst":true,"not_affected_if":["patched-release","callback-not-exposed"],"who_is_affected":"Teams running Waynboot-mall 2.0.0 or earlier where the order callback endpoint can be reached by untrusted clients. The sources do not say whether the endpoint is exposed by default in all deployments. Teams on a newer release, or with the callback path blocked from the internet, can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000628,"input_tokens":3348,"output_tokens":586,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111659':14A,17A '-2026':13A,16A '/callback/order/submit':35B,81C '2.0.0':31B,64C 'addressid':91C 'allow':71C 'arbitrari':89C 'attack':44B,73C,86C 'authent':41B,68C 'call':78C 'callback':5A,39B,85C 'cart':56B,93C,110C 'clear':55B,109C 'contain':65C 'creat':100C 'cve':12A,15A 'decrement':58B,112C 'detail':11A,54B,108C 'ecommerc':18B 'expos':9A,32B,105C 'forg':6A,75C 'host':23B 'id':94C 'intern':34B,80C 'java':19B 'json':98C 'mall':3A,26B,29B,62C 'member':50B,104C 'messag':37B,83C 'message-queu':36B,82C 'miss':67C 'order':7A,47B,76C,97C,101C 'packag':20B 'queue':38B,84C 'read':51B 'self':22B 'self-host':21B 'ship':10A,53B,107C 'stock':59B,113C 'store':52B,106C 'submit':46B 'suppli':88C 'unauthent':4A,43B,72C 'userid':90C 'vulner':69C 'waynboot':2A,25B,28B,61C 'waynboot-mal':1A,24B,27B,60C 'without':40B","nicknames":[],"mitigations":[],"who_affected":"Teams running Waynboot-mall 2.0.0 or earlier where the order callback endpoint can be reached by untrusted clients. The sources do not say whether the endpoint is exposed by default in all deployments. Teams on a newer release, or with the callback path blocked from the internet, can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111659","severity":null,"published_at":"2026-10-16T18:17:47+00:00","modified_at":"2026-10-21T21:17:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}