waynboot-mall EUVD-2026-103083

Exploitation requires that a waynboot-mall instance (version ≤ 2.0.0) be network-reachable by the attacker AND that the application have a working SMTP sender account configured - without a usable SMTP account the endpoint cannot actually relay mail, which is the primary practical limiter. No authentication, user interaction, or non-default configuration is needed because /callback/email is anonymously permitted in SecurityConfig by default, so a default deployment with mail enabled is directly exploitable. The limiting factors for defenders are therefore deployment exposure (internet-facing vs internal-only) and whether SMTP credentials are provisioned; impact is confined to outbound email abuse (phishing/spam/quota exhaustion from the operator's account) rather than data access or service disruption.

This is a genuine but moderate-severity issue, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, base 6.9) is internally consistent with the description: the /callback/email endpoint is anonymously mapped, so exploitation is remote, low-complexity, and requires no privileges or user interaction - the vector and the narrative agree, with no network-vs-local contradiction. Impact is correctly limited to low integrity (VI:L) with no confidentiality or availability impact in the 4.0 metrics, reflecting that the flaw lets an attacker abuse an email-sending function rather than read data or crash the service. No EPSS score, CISA KEV listing, or SSVC decision data was supplied, and no public exploit is identified in the inputs, so there is no evidence of active or automatable exploitation - risk here is driven by ease of abuse against an exposed instance, not by observed in-the-wild activity. The practical ceiling on severity is that this is an email/SMTP-relay abuse primitive (phishing, spam, quota exhaustion from the operator's account) rather than code execution or data theft; combined with the niche open-source footprint, real-world priority is moderate and situational - urgent only for operators actually running an internet-exposed waynboot-mall instance with a configured SMTP account.

An attacker discovers an internet-exposed waynboot-mall instance (version ≤ 2.0.0) and sends an unauthenticated POST to the anonymously mapped /callback/email endpoint with an attacker-chosen recipient, subject, and body. The application relays the message through the operator's configured SMTP account, letting the attacker send phishing or spam that appears to originate from the victim organization and burn its mail quota. No public exploit code is identified in the inputs, but the attack is trivial to reproduce from the referenced source and write-up given AV:N/AC:L/PR:N/UI:N.