CVE-2026-110123

Deferred Deferred - Pending Action

Makunet maku-boot Missing Authorization Allows Configuration Access

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110123

EUVD

EUVD-2026-98888

Affected Vendors & Products

Vendor	Product	Version / Range
makunet	maku-boot	4.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Maku-boot versions 4.3.0 to 5.0.0 have a missing authorization flaw. Authenticated users can access restricted endpoints like /sys/mail/config/list and /sys/sms/config/list without proper checks. This allows retrieval of sensitive data such as unmasked SMTP passwords and cloud service access keys. Attackers can also exploit /sys/mail/config/send to send emails to arbitrary recipients.

Detection Guidance

Check for unauthorized access to /sys/mail/config/list and /sys/sms/config/list endpoints. Monitor logs for requests to these paths. Verify if sensitive data like SMTP passwords or cloud access keys are exposed in responses.

Impact Analysis

An attacker with access could steal credentials for email and cloud services, leading to unauthorized access to sensitive data or systems. They might also send phishing emails from your domain, causing reputational damage or further breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's confidentiality and integrity requirements. For HIPAA, exposure of protected health information via email or SMS could result in compliance failures and penalties.

Mitigation Strategies

Update maku-boot to a version beyond 5.0.0 where the vulnerability is fixed. Restrict access to /sys/mail/config/list and /sys/sms/config/list endpoints. Review and rotate any exposed SMTP passwords or cloud access keys.

Hi! I’m here to help you understand CVE-2026-110123. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70