CVE-2026-111661 in waynboot-mall
Summary
by MITRE • 10/16/2026
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in waynboot-mall versions up to 2.0.0 represents a critical failure in access control mechanisms, specifically classified as a missing authentication flaw. This security defect allows unauthenticated actors to interact with sensitive backend functionality without providing valid credentials or session tokens. The root cause lies in the improper configuration of the application's routing and controller layer, where the endpoint /callback/email is mapped to EmailController.sendEmail without enforcing any form of identity verification or authorization checks. In a properly secured web application, endpoints that perform actions on behalf of users or utilize shared infrastructure resources such as SMTP servers must require authentication to ensure that only authorized entities can trigger these operations. The absence of this check creates an open channel for abuse, effectively bypassing the intended security perimeter and exposing internal services to direct external interaction.
From a technical perspective, the exploitation vector involves sending HTTP POST requests directly to the /callback/email endpoint with arbitrary parameters including subject lines, email content bodies, and recipient addresses. Because the application does not validate the source of these requests or verify that the sender is an authenticated user, attackers can inject malicious payloads into the message fields. This capability transforms the mail server associated with the operator's account into a relay for unsolicited communications. The flexibility in specifying recipients allows adversaries to target specific individuals for phishing campaigns or broadcast spam to large distributions lists. Furthermore, the ability to control both the content and the destination of emails enables sophisticated social engineering attacks where attackers can craft convincing messages that appear to originate from legitimate organizational domains, thereby increasing the likelihood of successful deception against end-users who trust the sender's identity.
The operational impact of this vulnerability extends beyond simple spam generation. Attackers can leverage the application’s SMTP credentials to exhaust mail quotas associated with the hosting provider or email service account. This denial-of-service condition can disrupt legitimate business communications by causing bounces, throttling, or complete suspension of email services due to policy violations regarding volume limits. Additionally, the reputation damage inflicted on the organization is significant; if sent emails are flagged as spam or phishing attempts by recipient mail servers, the domain’s sender score may degrade, leading to deliverability issues for all future legitimate correspondence. This secondary effect can have long-term consequences for organizational communication reliability and trustworthiness in digital interactions.
This vulnerability aligns with CWE-306, which describes missing authentication for critical function, indicating that a security-critical action was performed without adequate proof of user identity. It also maps to MITRE ATT&CK technique T1598.002, specifically Phishing via Spearheading using Environment Staging or Development Infrastructure, as attackers exploit misconfigured development or staging endpoints in production-like environments. To mitigate this risk, developers must immediately enforce authentication middleware on the /callback/email endpoint and any other sensitive API routes. Implementing role-based access control ensures that only authorized administrative users can trigger email sending functions. Additionally, integrating CAPTCHA challenges for public-facing forms and implementing rate limiting can further reduce the potential for abuse even if authentication is bypassed through other means. Regular security audits of route configurations are essential to prevent similar misconfigurations in future releases.