rConfig Core 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Rconfig |
|
No data.
No data.
References
History
Thu, 27 Aug 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 25 Aug 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance. | rConfig Core 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance. |
| Title | rConfig 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php | rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php |
Mon, 24 Aug 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Rconfig
Rconfig rconfig |
|
| Vendors & Products |
Rconfig
Rconfig rconfig |
Mon, 24 Aug 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance. | |
| Title | rConfig 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php | |
| Weaknesses | CWE-1188 CWE-306 |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-08-24T16:11:44.667Z
Updated: 2026-08-26T16:15:08.284Z
Reserved: 2026-08-21T17:52:36.078Z
Link: CVE-2026-77915
Vulnrichment
Updated: 2026-08-26T16:08:00.697Z
NVD
Status : Received
Published: 2026-08-24T17:18:18.450
Modified: 2026-08-26T17:17:14.627
Link: CVE-2026-77915
Redhat
No data.