SMTP server credentials are returned in calibre-web prior to 0.6.21. This allows the malicious user to view the SMTP server credentials and use them to access the SMTP server without authorization. The malicious user could send fraudulent, spam, or phishing emails on behalf of the legitimate user, compromise the user's confidential information, cause financial and reputational damage to the organization, and negatively affect the integrity and availability of the email server.