CVE-2026-77915: rConfig

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.

Affected products

• rConfig rConfig: from 8.0.0, before 8.2.10 (fixed in 8.2.10)

Published 2026-08-24. Last modified 2026-09-24.