maku-boot CVE-2026-110123

Requires a valid authenticated session on maku-boot (PR:L) - any low-privilege user suffices because the /sys/mail/config/list, /sys/sms/config/list and /sys/mail/config/send endpoints omit the required authority/permission checks. No special non-default configuration is needed: the missing authorization is present in the shipped controllers for versions 4.3.0 through 5.0.0. Limiting factors: exploitation is bounded to those three endpoints, needs network access to the management UI/API, and requires authentication (so exposure of the login surface to untrusted users - e.g. self-registration or shared internal access - materially raises risk); impact is further amplified only where mail/SMS/cloud integrations are actually configured so that live SMTP passwords and cloud keys exist to be harvested.

This is a genuine but access-gated credential-exposure issue rather than a mass-exploitable flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reach with low complexity and no user interaction, but PR:L means a valid authenticated low-privilege account is required - this is broken function-level authorization (CWE-862), not a pre-auth bypass despite the 'Authentication Bypass' tag. Impact is concentrated on confidentiality (VC:H) because unmasked SMTP passwords and Aliyun/Tencent/Qiniu/Huawei Cloud access keys are returned; integrity is only partial (VI:L) via arbitrary mail sending, and there is no availability impact (VA:N). No EPSS score, KEV listing, or POC/exploit-code signal is present in the input, so there is no evidence of active or at-scale exploitation; a public technical write-up (hackmd) and a VulnCheck advisory exist and describe the flaw in detail, lowering the barrier to reproduction. Net: a real priority for anyone running the affected versions because leaked cloud keys enable lateral/supply-chain abuse far beyond the app itself, but the authentication requirement and the product's niche footprint keep real-world mass-exploitation risk moderate rather than critical. Note the score of 7.1 is vendor/NVD-assigned and no CVSS 3.1 vector was supplied, so auth requirements are drawn from the 4.0 vector's PR:L.

A low-privileged but authenticated user (or an attacker who has phished or registered any account) on a maku-boot 4.3.0-5.0.0 instance calls /sys/mail/config/list and /sys/sms/config/list, which lack authority checks, and receives SMTP passwords and cloud access keys in cleartext. The attacker then uses those cloud keys to pivot into the organization's Aliyun/Tencent/Qiniu/Huawei infrastructure and abuses /sys/mail/config/send to send mail from the victim's domain for phishing. No public weaponized exploit is identified, but a detailed BFLA write-up and vendor advisory make reproduction straightforward.