disconf (Distributed Configuration Management Platform) 2.6.36 contains an Incorrect Access Control flaw that allows any unauthenticated user to call the /api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list endpoints. This flaw results in full read access to every configuration item and configuration file stored by the platform, potentially exposing sensitive data such as credentials, secrets, and system settings. The underlying weakness is an overly permissive whitelist that bypasses authentication checks, leading to a classic Unauthorized Read scenario.

The affected product is disconf version 2.6.36, a distributed configuration management platform used to centralize configuration for various services. No vendor name is specified, so the platform should be identified by its upstream project source. Any deployment running exactly this version is vulnerable.

While no CVSS score is listed, the lack of authentication on configuration endpoints means a remote attacker can read arbitrary configuration data from the network. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, but the exposed data can enable credential theft, privilege escalation, or further network pivoting. The attack vector is inferred to be remote over the network via HTTP, as the APIs are publicly reachable and do not require any authentication token.