CVE-2026-77915: rConfig 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php

Published Aug 24, 2026
·
Updated

rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.

Affected Software

2 affected components
rConfig>8.0.0<=8.2.10
rConfig<8.2.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade rConfig to a version that resolves this vulnerability.

    Fixed in 8.2.10
  2. Upgrade

    Upgrade rConfig to a version that resolves this vulnerability.

    Fixed in 8.2.13
  3. Configuration

    In routes/web.php, remove the duplicate bare Auth::routes() call so the POST /register route does not get re-enabled after it is explicitly disabled, preventing unauthorized admin self-registration.

    rConfig (routes/web.php) POST /register route registration = disabled (avoid duplicate Auth::routes() that re-enables /register)

Event History

Aug 24, 2026
CVE Published
via MITRE·04:11 PM
Data Sourced
via MITRE·04:11 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

Any unauthenticated remote attacker who can reach the rConfig web application can register an account and receive Administrator-level access. No existing account, credentials, or user interaction is required.

2

Which deployments are affected?

The issue affects rConfig versions 8.0.0 before 8.2.13. It results from the exposed POST /register route and the default Admin value for the users.role column.

3

What can an attacker do after registration?

A newly registered account is immediately authenticated with Admin-level access. This can expose stored device credentials and user data, and allows API token issuance.

4

How can I determine whether an instance has been exploited?

Review user accounts for unexpected registrations, especially Administrator accounts that were not created through approved administration processes. Also review API token issuance and access associated with unfamiliar accounts.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203