CVE-2026-77915
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.
Risk Assessment
Authentication bypass allows unauthorized individuals to gain full control over the rConfig system, including access to sensitive data and the ability to issue API tokens. This can lead to compromise of the entire infrastructure.
Recommendation
Update rConfig Core to version 8.2.10 or later that includes a fix. Immediately check for unauthorized admin accounts and reset all credentials.
Other vulnerabilities in rConfig Core
See all- CVE-2026-77914Medium
rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability allowing authenticated users to read arbitrary files by supplying crafted filenames with traversal sequences to the export download endpoint. Attackers can escape the intended export directory and access files readable by the application process.
- CVE-2026-63102Medium
rConfig Core before version 8.2.8 contains a privilege escalation vulnerability. Authenticated users can assign arbitrary roles to any account via an unvalidated role field in the Users API, without admin-level authorization checks.
Original NVD description (English source)
rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS