CVE-2026-111659
Received Received - Intake

Unauthenticated Order Forgery in Waynboot-mall

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111659
EUVD
EUVD-2026-103081

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wayn111 waynboot-mall 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication flaw in waynboot-mall through version 2.0.0. It allows unauthenticated attackers to forge orders by exploiting an internal callback endpoint (/callback/order/submit). Attackers can create orders for any user by supplying arbitrary userId, addressId, and cart IDs in the order JSON payload. This exposes stored shipping details, clears user carts, and decrements product stock without proper checks.

Detection Guidance

Check for unauthorized POST requests to /callback/order/submit, /callback/order/unpaid, or /callback/email endpoints. Monitor logs for suspicious order creation, cancellation, or email relay activities without authentication. Use network traffic analysis tools to detect unusual JSON payloads containing arbitrary userId, addressId, or cart IDs.

Impact Analysis

An attacker could create unauthorized orders for any user, exposing their shipping addresses and personal details. They could also cancel pending orders, restoring product stock without verification, and send phishing or spam emails from the operator's trusted SMTP account. This disrupts normal operations and may lead to financial or reputational damage.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized exposure of user shipping details and potential processing of personal data without consent. It may also breach HIPAA if shipping or order data includes protected health information. Organizations using this software could face regulatory penalties for failing to protect sensitive user data.

Mitigation Strategies

Immediately restrict access to /callback/** endpoints by updating Spring Security configuration to require authentication. Disable anonymous access to these endpoints and implement input validation for JSON payloads in order controllers. Patch to the latest version if available or apply vendor fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart