Waynboot-mall EUVD-2026-103081

The specific prerequisite is network reachability of the /callback/order/submit endpoint, which is an internal message-queue callback that waynboot-mall's SecurityConfig exposes without any authentication filter - any party able to reach the mobile API can invoke it. No credentials, tokens, or user interaction are required, and the attacker supplies arbitrary userId, addressId and cart ids directly in the order JSON. The principal LIMITING factor is deployment topology: if the callback endpoint is isolated on an internal-only network segment (as a genuine MQ callback ideally would be) rather than internet-exposed, remote exploitation is constrained to attackers with network access to the API; no other non-default configuration toggle is required.

All exploitability signals point to a trivially reachable flaw: the provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable endpoint requiring no authentication, no user interaction and low attack complexity, and CWE-306 (missing authentication) is consistent with this. However, impact is bounded: VC:L/VI:L/VA:N means only limited confidentiality (stored shipping details) and limited integrity (forged orders, cleared carts, stock decrement) with no availability impact, which is why the base score is a MEDIUM 6.9 rather than critical. Exploitation is well-documented - VulnCheck published an advisory and a detailed public HackMD writeup references the exact vulnerable source lines (SecurityConfig, SubmitOrderController, MobileOrderServiceImpl) - but the input provides no explicit POC/exploit-code flag, so per convention no packaged public exploit is confirmed, though the writeup effectively documents the attack. No EPSS score and no CISA KEV status were provided, so exploitation probability and in-the-wild activity cannot be asserted. Net: exploitation is easy and publicly explained, but the affected product is a niche open-source mall project with a small real-world footprint and limited per-incident impact, so this is a moderate, not top-tier, priority. MISSING DATA: EPSS and KEV absent from input; no vendor patch version identified.

An unauthenticated attacker sends a crafted HTTP POST to the internal /callback/order/submit message-queue callback endpoint, which Spring Security leaves unauthenticated, supplying an order JSON with an arbitrary userId, addressId and cart ids. This forges an order on behalf of any member, exposing that member's stored shipping details, clearing their cart and decrementing product stock. A detailed public technical writeup documents the endpoint and parameters, though no packaged exploit code is confirmed in the input.