disconf (Distributed Configuration Management Platform) version 2.6.36 implements an Incorrect Access Control flaw that allows any unauthenticated user to invoke the /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list endpoints. The LoginInterceptor explicitly whitelists these four paths, bypassing authentication entirely, thereby granting full read access to every configuration item and file stored by the platform. The exposed data can include credentials, secrets and system settings, making this a classic Unauthorized Read scenario.

The vulnerable product is disconf version 2.6.36, an open‑source distributed configuration management platform. Any deployment that runs exactly this version is affected. No commercial vendor name is specified, so the upstream project source should be identified as the owner of the affected binary.

The CVSS score of 9.8 marks the vulnerability as critical, though the EPSS score of < 1% indicates a low likelihood of exploitation in the near term. The exposed endpoints are reachable over HTTP and do not require any authentication, so a remote attacker can obtain arbitrary configuration data from the network. The vulnerability is not listed in the CISA KEV catalog, but the information disclosed can allow credential theft, privilege escalation or subsequent network pivoting. The attack vector is inferred to be remote over the network via HTTP, as the APIs are publicly reachable without credentials.