Makunet Maku Boot 4.3.0 Through 5.0.0 Missing Authorization Via Mail And Sms Config Endpoints

Back www.vulncheck.com

Makunet Maku Boot 4.3.0 Through 5.0.0 Missing Authorization Via Mail And Sms Config Endpoints

www.vulncheck.com • October 14, 2026

Share: View original

Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints

maku-boot >= 4.3.0, = 4.3.0, <= 5.0.0

CWE-862 Missing Authorization

maku-boot v5.0.0 Release Notes

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-110123: High-Risk Authorization Flaw in Maku Boot A missing authorization vulnerability (CVE-2026-110123) has been identified in Maku Boot versions 4.3.0 to 5.0.0, allowing authenticated users to access sensitive mail and SMS configurations without proper authority checks. This flaw enables attackers to retrieve unmasked SMTP passwords and cloud access keys, potentially leading to unauthorized actions such as sending emails to arbitrary recipients. The vulnerability affects deployments that are internet-accessible and where low-privilege accounts are available. The flaw was disclosed on October 13, 2026, and is classified with a CVSS score of 7.1, indicating a high severity. Immediate action is recommended to mitigate risks, including upgrading to a patched version and reviewing access controls. Current exploitation status is unknown, but the potential for abuse is significant. 1 sources 65

Extracted Entities

CWE Weaknesses (1)

CWE-862 - Missing Authorization