PT-2026-82338 · Isconf · Disconf
CVE-2026-75338
·
Published
2026-08-26
·
Updated
2026-08-27
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
disconf version 2.6.36
Description
Incorrect Access Control allows anonymous attackers to read all configuration items and files managed by the config center. This occurs because the
LoginInterceptor explicitly whitelists specific config-fetching API endpoints, exposing them without authentication. The affected endpoints are '/api/config/item', '/api/config/file', '/api/config/list', and '/api/config/simple/list'.Recommendations
For version 2.6.36, restrict access to the '/api/config/item', '/api/config/file', '/api/config/list', and '/api/config/simple/list' endpoints to ensure they require authentication.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Disconf