CVE-2026-111659 Details

A missing authentication vulnerability has been identified in Waynboot-Mall versions through 2.0.0. This vulnerability allows unauthenticated attackers to forge orders by calling the internal '/callback/order/submit' message-queue callback. Attackers can manipulate the order JSON to include arbitrary user IDs, address IDs, and cart IDs, creating orders for any member. This exploitation also exposes stored shipping details, clears the victim's cart, and decrements product stock.

Remove the public anonymity of the '/callback/**' routes and require authentication with a shared secret header. In the order submission process, enforce ownership checks for addresses and carts, and scope order cancellations to the specific user and order involved. For the email callback, either eliminate the public route or impose strict controls on the content and recipients.