Medium severity · published Oct 16, 2026
CVE-2026-111659
Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
waynboot-mall · wayn111
through 2.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111659
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111659
github.com
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-common/src/main/java/com/wayn/common/core/service/shop/impl/MobileOrderServiceImpl.java#L225-L307
github.com
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/api/controller/callback/SubmitOrderController.java#L34-L39
github.com
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/framework/config/SecurityConfig.java#L66
hackmd.io
https://hackmd.io/@hieuPenguinnn/waynboot-mall-unauth-callback-order-forgery-cancel-mail-relay
www.vulncheck.com
https://www.vulncheck.com/advisories/waynboot-mall-through-2.0.0-unauthenticated-order-forgery-via-callback-order-submit
More from waynboot-mall
6.5
CVE-2026-111660
waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
6.3
CVE-2026-110125
waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints
5.4
CVE-2026-110126
waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints
5.3
CVE-2026-111661
waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint
4.3
CVE-2026-110127
waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints