EUVD-2026-66815
GHSA-3w5f-m72v-wjf2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated single-request read over the network gives AV:N/AC:L/PR:N/UI:N and C:H; the description shows only configuration disclosure, so I and A are N, not H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.
AnalysisAI
Unauthenticated configuration disclosure in Baidu disconf 2.6.36 lets any anonymous network attacker read every configuration item and file managed by the config center. The LoginInterceptor whitelists four config-fetching endpoints (/api/config/item, /api/config/file, /api/config/list, /api/config/simple/list), bypassing authentication entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to a disconf 2.6.36 config center; the four endpoints (/api/config/item, /api/config/file, /api/config/list, /api/config/simple/list) are unauthenticated by design of the LoginInterceptor whitelist, so no credentials, tokens, user interaction, or special client configuration are needed against a default 2.6.36 deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The raw CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H) overstates direct impact: the described behavior is unauthenticated read of configuration, which is a confidentiality breach, not integrity or availability loss, so the I:H/A:H components are not supported by the description and my independent assessment is 7.5 (confidentiality-only). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers an internet-exposed disconf instance and issues an unauthenticated GET to /api/config/list to enumerate managed applications, then pulls /api/config/file and /api/config/item to dump full configuration contents including embedded database credentials and API keys. A public PoC/write-up exists, and given AV:N/AC:L/PR:N the attacker needs no account, no user interaction, and only a single HTTP request per endpoint, making the harvested secrets immediately usable for lateral movement into backend systems. |
| Remediation | No vendor-released patch identified at time of analysis - disconf is a largely inactive/archived project, so a fixed release should not be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all systems running Baidu disconf 2.6.36 and catalog every credential or sensitive value stored in managed configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today