CVE-2026-111661: Missing Authentication for Critical Function in wayn111 waynboot-mall

CVE-2026-111661 describes a missing authentication vulnerability in waynboot-mall through version 2.0.0. The vulnerability exists because the /callback/email endpoint is anonymously accessible, enabling unauthenticated attackers to invoke EmailController.sendEmail. Attackers can supply arbitrary subject, content, and recipient fields, causing emails to be sent from the operator's SMTP account without authorization.

An attacker can send arbitrary emails from the operator's SMTP account without authentication. This can lead to phishing attacks, spam distribution, and exhaustion of the mail quota associated with the operator's email service. There is no indication of privilege escalation or direct system compromise beyond email abuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /callback/email endpoint to authenticated users only or block access via network controls to prevent unauthenticated email sending.