CVE-2026-75338 in Disconf

Riassunto

di MITRE • 27/08/2026

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsabile: MITRE
• Prenotare: 17/08/2026
• Divulgazione: 27/08/2026
• Moderazione: accettato
• Voce: VDB-396030
• CPE: pronto
• CWE: CWE-284 (confermato)
• CVSS: 5.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-75338
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-75338
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-75338/