What’s Vulnerable › Vulnerabilities

CVE-2026-77915: rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-14
• Weakness: CWE-306

Description

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.

Affected products

• rconfig: from 8.0.0 before 8.2.10 — fixed in 8.2.10

How to fix

Upgrade to a fixed version: rconfig 8.2.10. Check the vendor advisory for mitigations.

References

• https://github.com/rconfig/rconfig/releases#release-core-8.2.10
• https://github.com/rconfig/rconfig/security/advisories/GHSA-w3hx-9cxg-5ccr
• https://www.vulncheck.com/advisories/rconfig-unauthorized-admin-registration-via-web-php

Get alerted when CVE-2026-77915 or the next vulnerability affects your stack