CVE-2026-110123 in maku-boot
Summary
by MITRE • 10/13/2026
Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Makunet maku-boot versions 4.3.0 through 5.0.0 represents a critical failure in server-side access control mechanisms, specifically categorized under CWE-287 as Improper Authentication and CWE-916 as Improper Control of Interaction Between Multiple Admin Privileged Functions. This flaw manifests within the system's administrative interface endpoints designed for managing communication configurations. The core technical deficiency lies in the absence of rigorous authorization checks when processing requests to specific API routes, namely /sys/mail/config/list and /sys/sms/config/list. While these endpoints are ostensibly protected by an authentication layer that verifies user identity, they fail to validate whether the authenticated session possesses the necessary administrative privileges or role-based permissions required to access sensitive configuration data. This oversight allows any validly authenticated user, regardless of their actual privilege level within the application hierarchy, to bypass intended restrictions and interact with these endpoints as if they were system administrators.
The operational impact of this vulnerability is severe due to the nature of the data exposed through these unsecured routes. By exploiting the missing authorization logic on /sys/mail/config/list, an attacker can retrieve detailed SMTP server configurations which include fully unmasked passwords used for email transmission services. Similarly, access to /sys/sms/config/list reveals cloud provider integration details, exposing sensitive API credentials such as Aliyun, Tencent Cloud, Qiniu, or Huawei Cloud access keys and secret keys. These credentials are typically treated with the highest level of security sensitivity because they grant programmatic control over critical infrastructure resources including email delivery systems and cloud storage or compute services. The exposure of these secrets in plaintext allows an attacker to fully compromise the confidentiality and integrity of the organization's communication channels and potentially gain unauthorized access to associated cloud environments, leading to data exfiltration, service disruption, or further lateral movement within the network.
Beyond passive information disclosure, the vulnerability extends into active exploitation capabilities through the /sys/mail/config/send endpoint. Although this specific endpoint may have its own distinct security controls in some implementations, the context provided indicates that it is also susceptible to abuse by authenticated users who can leverage their valid session tokens to send emails to arbitrary recipients without proper authorization checks. This capability transforms a simple information leak into an active attack vector for phishing campaigns, spam distribution, or social engineering attacks originating from trusted domains associated with the victim organization. The ability to spoof internal communications significantly damages organizational trust and reputation while potentially facilitating further compromise of other systems that rely on email-based verification protocols.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts, where attackers use legitimate credentials to maintain access or escalate privileges within the target environment. The exploitation path involves initial authentication followed by unauthorized API interaction, which is characteristic of horizontal privilege escalation scenarios often seen in web application frameworks that rely on middleware for security checks but fail to enforce granular role-based access control at the endpoint level. To mitigate this risk, immediate remediation should focus on implementing strict authorization policies for all administrative endpoints. Developers must ensure that every request to sensitive configuration routes undergoes a comprehensive permission verification process that validates not only authentication status but also specific role assignments or capability flags associated with the user account. Additionally, it is imperative to rotate all exposed credentials immediately upon confirmation of exploitation and to implement logging mechanisms that detect anomalous access patterns to these endpoints by non-administrative users. Future development cycles should adopt a principle of least privilege architecture where default permissions are restrictive and explicit grants are required for sensitive operations, thereby preventing similar authorization bypasses in subsequent software versions.