CVE-2026-77915

Name of the Vulnerable Software and Affected Versions rConfig versions 8.0.0 through 8.2.12

Description An authentication bypass exists due to a duplicate Auth::routes() call in the routes/web.php file, which inadvertently re-enables the POST /register endpoint after it had been disabled. This allows unauthenticated attackers to self-register accounts. Because the registration controller does not assign a specific role and the users.role column defaults to Admin, newly created accounts are granted full Administrator privileges. This can lead to unauthorized access to stored device credentials, user data, and the issuance of API tokens.

Recommendations Update rConfig to version 8.2.13 or later. As a temporary mitigation, restrict access to the POST /register endpoint.