Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-77915: rConfig allows anyone to register as admin
CVE-2026-77915 · published 10 days ago
Summary
Versions of rConfig from 8.0.0 through 8.2.12 let a person who is not logged in create a new account that automatically receives administrator rights. With that access they can view saved device passwords, personal data, and create new API tokens. Upgrade to rConfig 8.2.13 or later, or disable the public registration feature, to stop the risk.
What to do
- Update rconfig rconfig to version 8.2.10 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| rconfig | rconfig | < 8.2.10 |
Original advisory text
rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php
rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.
References
- https://github.com/rconfig/rconfig/security/advisories/GHSA-w3hx-9cxg-5ccr vendor-advisory
- https://github.com/rconfig/rconfig/releases#release-core-8.2.10 release-notes
- https://www.vulncheck.com/advisories/rconfig-unauthorized-admin-registration-via... third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-77915 Vendor Advisory
- https://github.com/rconfig/rconfig Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77915... Vendor Advisory
Severity
9.3
Critical
CVSS 3.1: 9.8 (MITRE)
CVSS 4.0: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-306Missing Authentication for Critical Function
CWE-1188Initialization of a Resource with an Insecure Default
Timeline
Published24 Aug 2026
Updated2 Sep 2026
First seen24 Aug 2026
Monitor software like this
Free during beta