CVE-2026-111661 [MEDIUM] – waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows un

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator’s SMTP account for phishing, spam, and mail quota exhaustion.