{"id":"CVE-2026-111661","kind":"vulnerability","aliases":["CVE-2026-111661"],"related":[],"title":"waynboot-mall: unauthenticated endpoint lets anyone send email from the operator's SMTP account","description":"waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.","summary":"waynboot-mall through 2.0.0 maps a /callback/email endpoint without authentication, so anyone can POST a recipient, subject and body to it. The server then sends that mail through the operator's own SMTP account, enabling phishing, spam and exhaustion of the mail quota.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","self-hosted","smtp","waynboot-mall"],"not_affected_if":["auth-required","not-running-waynboot-mall"],"how_to_check":"- Look for the `/callback/email` mapping in `EmailController.sendEmail` and check whether it sits behind an authentication filter or security configuration.\n- Check the installed version: `unknown` if the sources do not say how to read it; if the project is `2.0.0` or earlier, treat it as affected.\n- Send an unauthenticated POST to `/callback/email` on a test instance and see whether it returns success.","fix":"- Upgrade waynboot-mall past `2.0.0`: unknown, the sources do not name a fixed version.\n- Until patched, block `/callback/email` at the reverse proxy or require authentication on that route.\n- Rotate the SMTP account password if the endpoint was reachable from the internet.","status":"open","published_at":"2026-10-16T18:17:47+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:42:22+00:00","updated_at":"2026-10-25T03:42:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:42:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade waynboot-mall past `2.0.0`: unknown, the sources do not name a fixed version.\n- Until patched, block `/callback/email` at the reverse proxy or require authentication on that route.\n- Rotate the SMTP account password if the endpoint was reachable from the internet.","reach":"internet","title":"waynboot-mall: unauthenticated endpoint lets anyone send email from the operator's SMTP account","impact":"medium","summary":"waynboot-mall through 2.0.0 maps a /callback/email endpoint without authentication, so anyone can POST a recipient, subject and body to it. The server then sends that mail through the operator's own SMTP account, enabling phishing, spam and exhaustion of the mail quota.","category":"package","nicknames":[],"who_cares":["waynboot-mall","java","self-hosted","smtp"],"confidence":0.6,"needs_auth":"no","worst_case":"Attackers send phishing and spam mail from the operator's SMTP account","analyst_note":"Confirm the fixed version and whether the endpoint is exposed by default; check the project repository and the NVD entry for patch details.","how_to_check":"- Look for the `/callback/email` mapping in `EmailController.sendEmail` and check whether it sits behind an authentication filter or security configuration.\n- Check the installed version: `unknown` if the sources do not say how to read it; if the project is `2.0.0` or earlier, treat it as affected.\n- Send an unauthenticated POST to `/callback/email` on a test instance and see whether it returns success.","needs_analyst":true,"not_affected_if":["auth-required","not-running-waynboot-mall"],"who_is_affected":"Teams that run waynboot-mall version 2.0.0 or earlier with the email callback route reachable over the network. The flaw is the missing auth check on the email endpoint, so any deployment exposing that route is exposed. Teams not running this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":3358,"output_tokens":705,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111661':18A,21A '-2026':17A,20A '/callback/email':38B,98C '2.0.0':35B,79C 'account':15A,65B,119C 'allow':86C 'anonym':96C 'anyon':7A,43B 'arbitrari':91C 'attack':88C,100C 'authent':41B,83C 'bodi':50B 'call':94C 'caller':104C 'caller-suppli':103C 'contain':80C 'content':107C 'cve':16A,19A 'email':9A,92C 'emailcontroller.sendemail':111C 'enabl':66B 'endpoint':5A,39B,99C 'exhaust':70B,126C 'host':26B 'java':22B 'let':6A 'mail':58B,73B,124C 'mall':3A,30B,33B,77C 'map':36B,97C 'messag':113C 'miss':82C 'oper':12A,61B,116C 'packag':23B 'phish':67B,121C 'post':45B,102C 'quota':74B,125C 'recipi':47B,109C 'self':25B 'self-host':24B 'send':8A,56B,90C,112C 'server':54B 'smtp':14A,27B,64B,118C 'spam':68B,122C 'subject':48B,106C 'suppli':105C 'unauthent':4A,87C 'vulner':84C 'waynboot':2A,29B,32B,76C 'waynboot-mal':1A,28B,31B,75C 'without':40B","nicknames":[],"mitigations":[],"who_affected":"Teams that run waynboot-mall version 2.0.0 or earlier with the email callback route reachable over the network. The flaw is the missing auth check on the email endpoint, so any deployment exposing that route is exposed. Teams not running this project can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111661","severity":null,"published_at":"2026-10-16T18:17:47+00:00","modified_at":"2026-10-16T22:17:21+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}