CVE-2026-77915

CRITICAL 9.8

rConfig 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.

CWE	CWE-306 CWE-1188
Vendor	rconfig
Product	rconfig
Published	Aug 24, 2026

Stay Ahead of the Next One

Get instant alerts for rconfig rconfig

Be the first to know when new critical vulnerabilities affecting rconfig rconfig are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

rconfig / rconfig

8.0.0 < 8.2.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rconfig/rconfig/security/advisories/GHSA-w3hx-9cxg-5ccr github.com: https://github.com/rconfig/rconfig/releases#release-core-8.2.10 vulncheck.com: https://www.vulncheck.com/advisories/rconfig-unauthorized-admin-registration-via-web-php

Credits

Adam Nurudini (@QwesiRED)