CVE-2026-75338

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.

• CWE-284

• https://github.com/fangtang7/CVE/blob/main/disconf/Unauthenticated.md
• https://github.com/fangtang7/CVE/blob/main/disconf/Unauthenticated.md

Published

Aug 26, 2026

Last Modified

Aug 27, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75331tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leadi…4.6
• CVE-2026-75332Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Fo…9.1
• CVE-2026-75333yx-image-recognition v1.0 is vulnerable to Path Traversal. P…7.5
• CVE-2026-75334The report module in the backend of smart-web2 v1.3.1 is vul…9.8
• CVE-2026-75336Funiture 1.0.0 is vulnerable to SQL Injection in the backend…9.8
• CVE-2026-75337The static resource interface /api/static/{deployKey}/ of Yu…9.8
• CVE-2026-75339The storage endpoint /storage/upload of cjbi admin3 v3.0.0 a…8.8
• CVE-2026-7534The SUMO Reward Points plugin for WordPress is vulnerable to…7.2
• CVE-2026-75340The device metadata import interface /device/instance/{produ…9.1
• CVE-2026-7535A vulnerability was found in Open5GS up to 2.7.7. This affec…4.3
• CVE-2026-75357An issue in Bilibili Desktop v.1.17.9 allows a remote attack…9.8
• CVE-2026-7536A vulnerability was determined in Open5GS up to 2.7.7. This …5.5