← Back to Dashboard

CVE-2026-75338

CRITICAL NVD
CVSS Score
9.8
Severity
CRITICAL
Source
NVD
Published
Aug 26, 2026
Description

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.

View Full Details ← Back