A couple issues:
1) ConfigSchema.getOptions() returns a live list, meaning callers have access to the underlying list of ConfigOptions. This should not be the case, modifications should only be done via the public APIs on ConfigSchema. Change ConfigSchema to return a copied, immutable list.
2) All access to configOptions needs to be synchronized.