waynboot-mall version 2.0.0 contains a missing authentication flaw that allows anyone to POST to the /callback/email endpoint and supply any subject, recipient, and body. The EmailController sends the request through the operator’s SMTP account, enabling attackers to generate arbitrary email. This can be exploited for phishing, spam campaigns, or intentional exhaustion of the mail quota, thus creating denial of service effects via carrier or protocol limits.

The affected system is the waynboot-mall application, version 2.0.0, provided by the vendor wayn111. No specific sub‑components or patch versions are listed; users running this release are vulnerable.

The CVSS base score of 6.9 indicates a moderate severity, and the flaw is exploitable over a public network with no authentication. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can submit the unauthenticated request easily by sending an HTTP POST to the exposed endpoint, making the risk primarily driven by the lack of access control (CWE‑306).