CVE-2026-110123: Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints
Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit the affected endpoints because the required authority checks are missing. No additional user interaction is required.
What sensitive information can be exposed?
The mail and SMS configuration endpoints can disclose unmasked SMTP passwords and access keys for Aliyun, Tencent Cloud, Qiniu, or Huawei Cloud.
Can the issue be used for more than configuration disclosure?
Yes. An authenticated attacker can abuse /sys/mail/config/send to send email to arbitrary recipients.
Which deployments are affected?
Makunet maku-boot versions 4.3.0 through 5.0.0 are affected. The provided information does not identify any configuration prerequisite beyond an authenticated account.