Authentication Bypass in rConfig Leading to Admin Privilege Escalation

Executive Summary

CVE-2026-77915 is an authentication bypass flaw in rConfig versions 8.0.0 through 8.2.13. It allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate Auth::routes() call in routes/web.php that re-enables the POST /register route after it was disabled. The registration controller does not assign a role, and the users.role column defaults to Admin, granting immediate access to sensitive data like device credentials and user information.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized admin accounts by querying the users table for role='Admin' and is_socialite=0. Inspect web server logs for POST requests to /register. Verify file permissions on configuration files are not 0444.

Useful 0 Not Useful 0

Impact Analysis

Attackers can create unauthorized admin accounts, gaining full control over the rConfig system. This allows access to stored device credentials, user data, and API tokens, potentially leading to data breaches, unauthorized configuration changes, or further network compromise. The impact includes loss of confidentiality, integrity, and availability of critical system data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access controls. GDPR requires strict access controls and breach notification, while HIPAA mandates safeguards for sensitive health data. Unauthorized admin access could lead to data exposure, triggering regulatory penalties, fines, and reputational damage due to non-compliance with security and privacy standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rConfig to version 8.2.13 or later. Block access to /register at the reverse proxy or load balancer. Audit the users table for unrecognized admin accounts and revoke unauthorized access.

Useful 0 Not Useful 0