Live › vulnerability › CVE-2026-111661
Go to dashboardwaynboot-mall through 2.0.0 maps a /callback/email endpoint without authentication, so anyone can POST a recipient, subject and body to it. The server then sends that mail through the operator's own SMTP account, enabling phishing, spam and exhaustion of the mail quota.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run waynboot-mall version 2.0.0 or earlier with the email callback route reachable over the network. The flaw is the missing auth check on the email endpoint, so any deployment exposing that route is exposed. Teams not running this project can skip it.
No product ranges from the sources yet.
/callback/email mapping in EmailController.sendEmail and check whether it sits behind an authentication filter or security configuration.unknown if the sources do not say how to read it; if the project is 2.0.0 or earlier, treat it as affected./callback/email on a test instance and see whether it returns success.2.0.0: unknown, the sources do not name a fixed version./callback/email at the reverse proxy or require authentication on that route.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.
This page as .md · .json · in your agent: get_signal("CVE-2026-111661")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.