CVE-2026-75338

critical · 9.8

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.

9.8

CVSS

0.6%

EPSS (exploit prob.)

49th

EPSS percentile

2026-08-26

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-284

References

https://github.com/fangtang7/CVE/blob/main/disconf/Unauthenticated.md
https://github.com/fangtang7/CVE/blob/main/disconf/Unauthenticated.md

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-75338