CVE-2026-77915: rConfig 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php
rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rConfigto a version that resolves this vulnerability.Fixed in 8.2.10 - Upgrade
Upgrade
rConfigto a version that resolves this vulnerability.Fixed in 8.2.13 - Configuration
In routes/web.php, remove the duplicate bare Auth::routes() call so the POST /register route does not get re-enabled after it is explicitly disabled, preventing unauthorized admin self-registration.
rConfig (routes/web.php) POST /register route registration = disabled (avoid duplicate Auth::routes() that re-enables /register)
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the rConfig web application can register an account and receive Administrator-level access. No existing account, credentials, or user interaction is required.
Which deployments are affected?
The issue affects rConfig versions 8.0.0 before 8.2.13. It results from the exposed POST /register route and the default Admin value for the users.role column.
What can an attacker do after registration?
A newly registered account is immediately authenticated with Admin-level access. This can expose stored device credentials and user data, and allows API token issuance.
How can I determine whether an instance has been exploited?
Review user accounts for unexpected registrations, especially Administrator accounts that were not created through approved administration processes. Also review API token issuance and access associated with unfamiliar accounts.