CVE-2026-63102
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
rConfig Core before version 8.2.8 contains a privilege escalation vulnerability. Authenticated users can assign arbitrary roles to any account via an unvalidated role field in the Users API, without admin-level authorization checks.
Risk Assessment
An attacker can gain administrator privileges, leading to full control over the rConfig system, including configuration modification and access to sensitive data.
Recommendation
Upgrade rConfig Core to version 8.2.8 or later.
Other vulnerabilities in rConfig Core
See all- CVE-2026-77915Critical
rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.
- CVE-2026-77914Medium
rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability allowing authenticated users to read arbitrary files by supplying crafted filenames with traversal sequences to the export download endpoint. Attackers can escape the intended export directory and access files readable by the application process.
Original NVD description (English source)
rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features. rConfig Pro and Enterprise are not affected.