Missing Authorization in Makunet Maku-boot Allows Access to Sensitive Configuration Data

CVE-2026-110123

What is CVE-2026-110123?

Maku-boot versions 4.3.0 through 5.0.0 suffer from a missing authorization vulnerability that permits authenticated users to access sensitive mail and SMS configuration settings. This flaw allows attackers to call the /sys/mail/config/list and /sys/sms/config/list endpoints without proper authority checks. Consequently, they can retrieve sensitive unmasked SMTP passwords and access keys for cloud providers such as Aliyun, Tencent Cloud, Qiniu, or Huawei Cloud. Furthermore, attackers can exploit the /sys/mail/config/send endpoint to dispatch emails to arbitrary recipients, exacerbating the risk of unauthorized communication and potential data breaches.

References