{"id":"CVE-2026-77915","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-77915","summary":"rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to…","details":"rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.","published":"2026-08-24T17:18:18.450","modified":"2026-08-24T17:18:18.450","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/rconfig/rconfig/releases#release-core-8.2.10"},{"type":"WEB","url":"https://github.com/rconfig/rconfig/security/advisories/GHSA-w3hx-9cxg-5ccr"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/rconfig-unauthorized-admin-registration-via-web-php"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-24T17:18:18.450"}}