CVE-2026-75338

Received Received - Intake

Incorrect Access Control in Disconf 2.6.36

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: MITRE

Description

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-75338

EUVD

EUVD-2026-66815

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

disconf version 2.6.36 has an Incorrect Access Control vulnerability. Four config-fetching APIs (/api/config/item, /api/config/file, /api/config/list, /api/config/simple/list) are exposed without authentication. The LoginInterceptor whitelists these paths, allowing anonymous attackers to read all configuration items and files managed by the config center.

Detection Guidance

Check if the affected APIs /api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list are accessible without authentication. Use curl commands like: curl -I http://<target>/api/config/item to verify if responses are returned without requiring credentials.

Impact Analysis

An attacker could exploit this to access sensitive configuration data, including secrets, database credentials, or application settings. This could lead to further attacks like data breaches, unauthorized system access, or service disruption by manipulating configurations.

Compliance Impact

This vulnerability could violate GDPR (data protection) and HIPAA (health data privacy) by exposing sensitive configuration data. Unauthorized access to such data may result in non-compliance, legal penalties, or reputational damage due to breaches of confidentiality requirements.

Mitigation Strategies

Upgrade disconf to a version that fixes the Incorrect Access Control vulnerability. If an upgrade is not immediately possible, restrict access to the vulnerable APIs at the network level or disable them until a patch is applied.

Hi! I’m here to help you understand CVE-2026-75338. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70