CVE-2026-63102
rConfig Core < 8.2.8 Privilege Escalation via Users API role field
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features. rConfig Pro and Enterprise are not affected.
| CWE | CWE-915 |
| Vendor | rconfig |
| Product | rconfig v8 core |
| Published | Jul 20, 2026 |
| Last Updated | Jul 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for rconfig rconfig v8 core
Be the first to know when new medium vulnerabilities affecting rconfig rconfig v8 core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
rConfig / rConfig v8 Core
0 < 8.2.8
References
github.com: https://github.com/rconfig/rconfig/releases/tag/core-8.2.8 github.com: https://github.com/rconfig/rconfig/pull/325 github.com: https://github.com/rconfig/rconfig/commit/84822f4051ed97d651b1b4d191c6da2aa8c3c037 vulncheck.com: https://www.vulncheck.com/advisories/rconfig-privilege-escalation-via-users-api-role-field
Credits
manasse VulnCheck