CVE-2026-110123: Missing Authorization in makunet maku-boot

CVE-2026-110123 describes a missing authorization vulnerability in makunet maku-boot versions 4.3.0 through 5.0.0. Authenticated users can call the endpoints /sys/mail/config/list and /sys/sms/config/list without required authorization, enabling them to read sensitive configuration data including unmasked SMTP passwords and access keys for Aliyun, Tencent Cloud, Qiniu, and Huawei Cloud. Additionally, the /sys/mail/config/send endpoint can be abused to send emails to arbitrary recipients. The CVSS 4.0 score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and partial impact on confidentiality and integrity.

An attacker with authenticated access can retrieve sensitive credentials such as SMTP passwords and cloud service access keys, potentially leading to unauthorized use of mail services and cloud resources. The ability to send mail to arbitrary recipients can facilitate spam or phishing campaigns originating from the vulnerable system. The vulnerability compromises confidentiality and integrity of sensitive configuration data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to the affected endpoints and monitor for unauthorized use of mail sending functionality. Do not rely on this vulnerability being mitigated without vendor confirmation.