Description

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T23:17:18.903Z",
  "pubdate": "2026-08-26T23:17:18.903Z",
  "executiveSummary": "The distributed configuration management platform Disconf version 2.6.36 contains a critical Incorrect Access Control vulnerability.\nThis security flaw stems from an overly permissive authentication whitelist within the application's interceptor logic, which inadvertently exposes sensitive configuration-fetching APIs to unauthenticated network requests.\nThe vulnerability allows anonymous, unauthorized attackers to remotely query and exfiltrate the entirety of the configuration data stored within the system.\nBecause Disconf is typically used to centralize sensitive environmental variables, database credentials, API keys, and internal service architecture details, the exposure of this information poses a severe risk to organizational confidentiality and infrastructure integrity.\nNo authentication or specific privileges are required for exploitation, as the affected endpoints are explicitly excluded from the platform's security boundary. This permits an attacker with network reach to the Disconf server to perform mass unauthorized enumeration and exfiltration of managed configuration files and items without any legitimate session tokens.",
  "technicalDetails": "The vulnerability resides in the application's access control enforcement mechanism, specifically within the LoginInterceptor component. This interceptor is responsible for validating user sessions before permitting access to protected configuration endpoints. However, the implementation includes a hardcoded whitelist that explicitly bypasses authentication checks for four critical API paths: /api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list.\nThe root cause is a failure to enforce the principle of least privilege during the design of the interceptor's filtering logic. By adding these paths to an 'allowed' list, the system treats any incoming request to these specific URIs as trusted, regardless of the presence or validity of a session cookie or authentication header. This bypasses the security interceptor's primary function, which is to verify the authorization status of the requester.\nThe attack flow is straightforward and does not require sophisticated techniques. An unauthenticated attacker sends standard HTTP GET requests to the identified vulnerable endpoints. For example, by targeting /api/config/item or /api/config/file, the attacker can leverage the platform's native functionality to retrieve stored configuration values. Because these endpoints are designed to fetch data managed by the configuration center, they perform database queries to return the requested configuration items and files directly to the caller. The LoginInterceptor ignores the lack of credentials, allowing the application to process the request as if it originated from an authorized internal service or administrator.\nThe impact of this vulnerability is significant in a microservices environment where Disconf serves as the source of truth for distributed nodes. Once an attacker gains access to these configurations, they can identify backend database credentials, third-party integration secrets, service discovery endpoints, and internal network topology. This level of exposure facilitates lateral movement, potential data breaches, and the compromise of downstream applications that rely on the integrity and secrecy of these configuration items. The exposure is total, meaning all managed configurations within the Disconf instance are vulnerable to mass scraping."
}