CVE-2026-75338

9.8 Critique

Publiée le 27/08/2026 à 01:17 · Modifiée le 09/09/2026 à 18:04 · Analyse NVD reportée · Source : cve@mitre.org

Description

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.

Traduire en français

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-284

Références

https://github.com/fangtang7/CVE/blob/main/disconf/Unauthenticated.md
https://github.com/fangtang7/CVE/blob/main/disconf/Unauthenticated.md

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories