Summary
CVE-2026-110123 is a high-severity missing authorization vulnerability in maku-boot that allows authenticated users to access mail and SMS configuration endpoints without the required authority checks. Exposed data may include unmasked SMTP passwords and cloud-provider access keys, while the mail sending function may allow messages to be sent to arbitrary recipients.
CVE-2026-110123 is a high-severity missing authorization vulnerability in maku-boot that allows authenticated users to access mail and SMS configuration endpoints without the required authority checks. Exposed data may include unmasked SMTP passwords and cloud-provider access keys, while the mail sending function may allow messages to be sent to arbitrary recipients.
Affected context
The issue occurs in maku-boot deployments where authenticated users can reach the mail and SMS configuration interfaces but authorization is not enforced for each endpoint. It is particularly risky when configuration responses contain plaintext or insufficiently masked credentials, or when mail-sending operations accept recipient-controlled input without additional permission checks.
The issue occurs in maku-boot deployments where authenticated users can reach the mail and SMS configuration interfaces but authorization is not enforced for each endpoint. It is particularly risky when configuration responses contain plaintext or insufficiently masked credentials, or when mail-sending operations accept recipient-controlled input without additional permission checks.
Exploit preconditions
- Attack surface: Application HTTP endpoints under
/sys/mailand/sys/sms - Required access: A valid authenticated account; the account may not need the intended administrative authority
- Trigger point: Requests to configuration-listing endpoints or the mail-send operation
- Why exploitation is possible: Endpoint-level authorization checks are missing or insufficient, allowing authenticated users to access protected configuration data and invoke sensitive functionality
- Attack surface: Application HTTP endpoints under
/sys/mailand/sys/sms - Required access: A valid authenticated account; the account may not need the intended administrative authority
- Trigger point: Requests to configuration-listing endpoints or the mail-send operation
- Why exploitation is possible: Endpoint-level authorization checks are missing or insufficient, allowing authenticated users to access protected configuration data and invoke sensitive functionality
Why this happens
The underlying flaw is an authorization design failure in which authentication is treated as sufficient for operations that require additional authority. Sensitive endpoints do not consistently verify the caller's permissions before returning configuration data or performing mail delivery. This maps to CWE-862, Missing Authorization, because access-control enforcement is absent or incomplete for protected resources and actions.
The underlying flaw is an authorization design failure in which authentication is treated as sufficient for operations that require additional authority. Sensitive endpoints do not consistently verify the caller's permissions before returning configuration data or performing mail delivery. This maps to CWE-862, Missing Authorization, because access-control enforcement is absent or incomplete for protected resources and actions.
Potential impact
- Attackers may disclose SMTP passwords and cloud-service access keys
- Attackers could use exposed credentials to access connected infrastructure or services
- Unauthorized users may send mail to arbitrary recipients
- Organizations may experience phishing, spam, reputational damage, or unexpected delivery costs
- Exposed secrets can enable follow-on compromise and lateral movement
- Attackers may disclose SMTP passwords and cloud-service access keys
- Attackers could use exposed credentials to access connected infrastructure or services
- Unauthorized users may send mail to arbitrary recipients
- Organizations may experience phishing, spam, reputational damage, or unexpected delivery costs
- Exposed secrets can enable follow-on compromise and lateral movement
General mitigation guidance
Mitigation generally focuses on enforcing authorization independently of
authentication for every sensitive resource and action.
Common defensive patterns include:
- Applying server-side, endpoint-level permission checks to configuration reads and mail-sending operations
- Using deny-by-default access policies with explicit roles for administrative functions
- Returning only the minimum configuration data required by an authorized workflow
- Avoiding storage and display of plaintext secrets, and using managed secret storage or short-lived credentials where possible
- Restricting outbound mail capabilities and validating recipient and sender policy
- Applying least privilege to service accounts and connected cloud credentials
- Auditing access decisions and sensitive configuration use
Mitigation generally focuses on enforcing authorization independently of
authentication for every sensitive resource and action.
Common defensive patterns include:
- Applying server-side, endpoint-level permission checks to configuration reads and mail-sending operations
- Using deny-by-default access policies with explicit roles for administrative functions
- Returning only the minimum configuration data required by an authorized workflow
- Avoiding storage and display of plaintext secrets, and using managed secret storage or short-lived credentials where possible
- Restricting outbound mail capabilities and validating recipient and sender policy
- Applying least privilege to service accounts and connected cloud credentials
- Auditing access decisions and sensitive configuration use
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis and review rules that flag controller methods lacking authorization annotations or checks
- Code review of every endpoint that reads secrets or performs external side effects
- API tests that exercise authenticated users with and without the required roles
- Policy checks requiring explicit authorization metadata for administrative routes
- Monitoring unusual configuration reads, secret exposure, and high-volume or unexpected mail delivery
- Automated security testing that verifies both authentication and authorization boundaries
Organizations can identify similar issues through:
- Static analysis and review rules that flag controller methods lacking authorization annotations or checks
- Code review of every endpoint that reads secrets or performs external side effects
- API tests that exercise authenticated users with and without the required roles
- Policy checks requiring explicit authorization metadata for administrative routes
- Monitoring unusual configuration reads, secret exposure, and high-volume or unexpected mail delivery
- Automated security testing that verifies both authentication and authorization boundaries
