High 7.1Published Oct 13, 2026

CVE-2026-110123Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints

Updated under an hour ago (Oct 28, 2026, 10:40 AM ET)

Does this affect you?

It affects makunet maku-boot. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.28%, higher than 20% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for makunet maku-boot

Exploited in the last 30 days

Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.28% (percentile 20)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 13, 2026

Affected products

Affected products

makunet maku-boot makunet:maku_boot (from the name)	from 4.3.0 through 5.0.0	CNA record

References

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/maku-boot-mail-sms-config-bfla	third-party-advisory
https://github.com/makunet/maku-boot/blob/4cd202b037e2ac47e366d4b0691fb387c764d308/maku-boot-system/src/main/java/net/maku/system/controller/SysMailConfigController.java#L53-L59	technical-description
https://github.com/makunet/maku-boot/blob/4cd202b037e2ac47e366d4b0691fb387c764d308/maku-boot-system/src/main/java/net/maku/system/controller/SysMailConfigController.java#L79-L84	technical-description
https://github.com/makunet/maku-boot/blob/4cd202b037e2ac47e366d4b0691fb387c764d308/maku-boot-system/src/main/java/net/maku/system/controller/SysSmsConfigController.java#L53-L59	technical-description
https://github.com/makunet/maku-boot/releases/tag/v5.0.0	release-notes
https://www.vulncheck.com/advisories/makunet-maku-boot-4.3.0-through-5.0.0-missing-authorization-via-mail-and-sms-config-endpoints	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.