CVE-2026-111660
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
Risk Assessment
An attacker could exploit this vulnerability to mass-cancel customer orders, potentially leading to financial losses, customer dissatisfaction, and incorrect stock levels.
Recommendation
Update waynboot-mall to a version later than 2.0.0 if available, or secure the /callback/order/unpaid endpoint by requiring authentication and authorization checks.
Other vulnerabilities in waynboot-mall
See all- CVE-2026-111661Medium
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.
- CVE-2026-111659Medium
Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.
- CVE-2026-110127Medium
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController. Authenticated members can modify or delete other members' cart items by enumerating sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.
- CVE-2026-110126Medium
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController. Authenticated members can modify or delete other members' shipping addresses by enumerating auto-increment address ids and sending POST /address or DELETE /address/{addressId} requests.
- CVE-2026-110125Medium
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.
Original NVD description (English source)
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS