CVE-2026-63102: rConfig Core < 8.2.8 Privilege Escalation via Users API role field
rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features. rConfig Pro and Enterprise are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rConfig Coreto a version that resolves this vulnerability.Fixed in 8.2.8 - Compensating control
If upgrading to 8.2.8 is not immediately possible, restrict access to the rConfig Core Users API endpoints used for user creation/profile updates to trusted/admin clients (e.g., via network controls/ACL) to reduce the ability for authenticated attackers to mass-assign roles.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63102?
CVE-2026-63102 has a medium severity rating of 5.4.
How do I fix CVE-2026-63102?
To fix CVE-2026-63102, upgrade rConfig to version 8.2.8 or later.
What kind of vulnerability is CVE-2026-63102?
CVE-2026-63102 is a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles.
Which versions of rConfig are affected by CVE-2026-63102?
rConfig versions prior to 8.2.8 are affected by CVE-2026-63102.
What can attackers do with CVE-2026-63102?
Attackers can exploit CVE-2026-63102 to assign unauthorized roles to user accounts.