Authentication Bypass and Privilege Escalation in rConfig

The vulnerability CVE-2026-77915 affects rConfig versions prior to 8.2.13. The issue stems from a redundant Auth::routes() call within the routes/web.php file, which inadvertently re-enables the registration endpoint after it had been explicitly disabled by the developers. When an unauthenticated attacker accesses the /register endpoint and creates a new account, the application fails to assign a restricted role during the account creation process. Consequently, the users.role column in the underlying database defaults to the 'Admin' privilege level. This flaw allows an attacker to achieve full administrative access without prior authentication, providing them with the ability to manage device configurations, harvest sensitive credentials stored within the application, access user data, and generate new API tokens for further persistence. This vulnerability is critical due to the ease of exploitation and the resulting high-privileged access granted to unauthorized users.

Impact

Successful exploitation allows unauthenticated attackers to obtain full administrative control over the rConfig instance. This access exposes the entirety of the network device management environment, including administrative credentials for managed network infrastructure, sensitive user information, and application API keys. Compromise of an rConfig instance could lead to widespread unauthorized access or configuration changes across the target organization's network devices.

Recommendation

• Immediately update rConfig instances to version 8.2.13 or later to patch the registration route conflict.
• Audit existing user accounts for any entries created or modified after the date the application was deployed, specifically looking for users with 'Admin' roles created through the registration controller.
• Review all API tokens for unexpected or suspicious issuance and revoke any tokens associated with unauthorized administrative accounts.
• Deploy the provided webserver detection rule to monitor for unauthorized access attempts to the /register endpoint.