CVE-2026-111661: waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated network attacker who can reach the /callback/email endpoint can exploit it. No credentials or user interaction are required.
What capabilities does exploitation provide?
An attacker can submit a POST request with an attacker-controlled recipient, subject, and message content. The application sends the resulting email through the operator's configured SMTP account.
Are default deployments affected?
The affected endpoint is anonymously mapped in the application's security configuration through version 2.0.0. Deployments that expose this endpoint and have SMTP sending configured are affected.
What can be done if patching is not immediately possible?
Restrict or block external access to /callback/email, such as with a reverse proxy or network access-control rule. Also review SMTP account limits and outbound-mail monitoring for unexpected messages or quota consumption.
How can administrators look for exploitation?
Review application and reverse-proxy logs for POST requests to /callback/email, then correlate them with SMTP or mail-provider logs for unexpected recipients, subjects, or sending volume from the application's SMTP account.