CVE-2026-77915

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rconfig/rconfig/releases#release-core-8.2.10
https://github.com/rconfig/rconfig/security/advisories/GHSA-w3hx-9cxg-5ccr
https://www.vulncheck.com/advisories/rconfig-unauthorized-admin-registration-via-web-php

Configurations

No configuration.

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) rConfig 8.0.0 antes de 8.2.13 contiene una vulnerabilidad de omisión de autenticación que permite a atacantes no autenticados auto-registrar cuentas con privilegios de Administrador completos debido a una llamada duplicada y sin formato a Auth::routes() en routes/web.php que vuelve a habilitar la ruta POST /register después de que fue deshabilitada explícitamente. Los atacantes pueden registrar una nueva cuenta que es inmediatamente autenticada con acceso de nivel de Administrador porque el controlador de registro no asigna un rol y la columna users.role por defecto es Admin, lo que permite el acceso a credenciales de dispositivos almacenadas, datos de usuario y emisión de tokens de API.

Information

Published : 2026-08-24 17:18

Updated : 2026-10-14 13:10

NVD link : CVE-2026-77915

Mitre link : CVE-2026-77915

CVE.ORG link : CVE-2026-77915

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2026-77915", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77915", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T16:07:58.990479Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/rconfig/rconfig", "vendor": "rconfig", "product": "rconfig", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.2.10", "versionType": "semver"}], "packageURL": "pkg:github/rconfig/rconfig", "defaultStatus": "affected"}]}], "published": "2026-08-24T17:18:18.450", "references": [{"url": "https://github.com/rconfig/rconfig/releases#release-core-8.2.10", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/rconfig/rconfig/security/advisories/GHSA-w3hx-9cxg-5ccr", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rconfig-unauthorized-admin-registration-via-web-php", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance."}, {"lang": "es", "value": "rConfig 8.0.0 antes de 8.2.13 contiene una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n que permite a atacantes no autenticados auto-registrar cuentas con privilegios de Administrador completos debido a una llamada duplicada y sin formato a Auth::routes() en routes/web.php que vuelve a habilitar la ruta POST /register despu\u00e9s de que fue deshabilitada expl\u00edcitamente. Los atacantes pueden registrar una nueva cuenta que es inmediatamente autenticada con acceso de nivel de Administrador porque el controlador de registro no asigna un rol y la columna users.role por defecto es Admin, lo que permite el acceso a credenciales de dispositivos almacenadas, datos de usuario y emisi\u00f3n de tokens de API."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "disclosure@vulncheck.com"}