Is CVE-2026-110123 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110123?

CVE-2026-110123 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-110123

Description

Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.