rConfig Core vulnerabilities

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability allowing authenticated users to read arbitrary files by supplying crafted filenames with traversal sequences to the export download endpoint. Attackers can escape the intended export directory and access files readable by the application process.

rConfig Core before version 8.2.8 contains a privilege escalation vulnerability. Authenticated users can assign arbitrary roles to any account via an unvalidated role field in the Users API, without admin-level authorization checks.