waynboot-mall CVE-2026-111660

No authentication is required: the /callback/order/unpaid endpoint in waynboot-mall through 2.0.0 is reachable without credentials (CWE-306), matching PR:N/UI:N in the vendor vector. The key enabling condition is that orderSn values are predictable - built from epoch seconds and a sequential counter - so an attacker can enumerate or guess valid order identifiers rather than needing to know them. Limiting factors: exploitation only affects orders that are currently pending/unpaid (there must be live unpaid orders to cancel), impact is bounded to order cancellation and stock manipulation rather than data disclosure or takeover, and the target instance must be network-reachable. This applies to default configurations of waynboot-mall at or below v2.0.0.

Signals are consistent in direction but point to a moderate, business-logic risk rather than a systemic emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which aligns with the CWE-306 (Missing Authentication) classification and the description's claim that /callback/order/unpaid requires no auth. Impact is deliberately scoped low in the vendor vector (VC:N/VI:L/VA:L): no data is disclosed, and the harm is limited to forced cancellation of pending orders and consequent stock manipulation - a data-integrity and limited-availability problem, not code execution or data theft, which is why the base score sits at 6.9 (Medium). No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input; absence of these is not evidence of safety but means widespread automated exploitation is not currently demonstrated. A detailed third-party technical writeup (hackmd) and direct source-code line references are cited, so the exploitation technique - predicting orderSn from epoch seconds plus a sequential counter - is publicly documented, lowering the barrier for a capable attacker even though no packaged exploit is confirmed. Net: a genuine, easily-triggered abuse-of-function flaw against an exposed instance, but the real-world blast radius is constrained by the product's niche footprint and the bounded (integrity/availability-only) impact.

An attacker enumerates valid orderSn values - which the writeup documents as derivable from epoch seconds plus a short sequential counter - and sends crafted unauthenticated POST requests to /callback/order/unpaid on a reachable waynboot-mall instance. Each request forces cancellation of another member's pending unpaid order, and because cancellation returns reserved inventory, the attacker can repeatedly manipulate product stock levels. Public technical details (hackmd writeup plus annotated source lines) describe the predictable-ID mechanism, so no authentication or prior access is needed.