CVE-2026-75338CWE-284broken-access-control

CVE-2026-75338

Critical · published August 27, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00606 · 48.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-27T03:17Z
References (2)
https://github.com/fangtang7/CVE/blob/main/disconf/Unauthenticated.md · [email protected]https://github.com/fangtang7/CVE/blob/main/disconf/Unauthenticated.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 AUG 06:53Z
    EPSS moved — → 0%
    epss
  • 26 AUG 00:00Z
    disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control
    cvelistv5