CVE-2026-77915

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77915", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-21T17:52:36.078Z", "datePublished": "2026-08-24T16:11:44.667Z", "dateUpdated": "2026-10-01T15:21:15.632Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T15:21:15.632Z"}, "title": "rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php", "descriptions": [{"lang": "en", "value": "rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance."}], "tags": ["x_open-source"], "datePublic": "2026-08-10T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "Missing Authentication for Critical Function", "type": "CWE"}, {"lang": "en", "cweId": "CWE-1188", "description": "Initialization of a Resource with an Insecure Default", "type": "CWE"}]}], "affected": [{"defaultStatus": "affected", "vendor": "rconfig", "product": "rconfig", "packageURL": "pkg:github/rconfig/rconfig", "repo": "https://github.com/rconfig/rconfig", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThan": "8.2.10"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.2.10"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "references": [{"url": "https://github.com/rconfig/rconfig/security/advisories/GHSA-w3hx-9cxg-5ccr", "name": "GitHub Security Advisory (GHSA-w3hx-9cxg-5ccr)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/rconfig/rconfig/releases#release-core-8.2.10", "name": "Release Notes", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/rconfig-unauthorized-admin-registration-via-web-php", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Adam Nurudini (@QwesiRED)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T16:07:58.990479Z", "id": "CVE-2026-77915", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T16:15:08.284Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77915", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T16:07:58.990479Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T16:08:00.697Z"}}], "cna": {"tags": ["x_open-source"], "title": "rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Adam Nurudini (@QwesiRED)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/rconfig/rconfig", "vendor": "rconfig", "product": "rconfig", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.2.10", "versionType": "semver"}], "packageURL": "pkg:github/rconfig/rconfig", "defaultStatus": "affected"}], "datePublic": "2026-08-10T00:00:00.000Z", "references": [{"url": "https://github.com/rconfig/rconfig/security/advisories/GHSA-w3hx-9cxg-5ccr", "name": "GitHub Security Advisory (GHSA-w3hx-9cxg-5ccr)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/rconfig/rconfig/releases#release-core-8.2.10", "name": "Release Notes", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/rconfig-unauthorized-admin-registration-via-web-php", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "Missing Authentication for Critical Function"}, {"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "Initialization of a Resource with an Insecure Default"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.2.10", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T15:21:15.632Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77915", "state": "PUBLISHED", "dateUpdated": "2026-10-01T15:21:15.632Z", "dateReserved": "2026-08-21T17:52:36.078Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-24T16:11:44.667Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageURL": "pkg:github/rconfig/rconfig", "product": "rconfig", "repo": "https://github.com/rconfig/rconfig", "vendor": "rconfig", "versions": [{"lessThan": "8.2.10", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance."}, {"lang": "es", "value": "rConfig 8.0.0 antes de 8.2.13 contiene una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n que permite a atacantes no autenticados auto-registrar cuentas con privilegios de Administrador completos debido a una llamada duplicada y sin formato a Auth::routes() en routes/web.php que vuelve a habilitar la ruta POST /register despu\u00e9s de que fue deshabilitada expl\u00edcitamente. Los atacantes pueden registrar una nueva cuenta que es inmediatamente autenticada con acceso de nivel de Administrador porque el controlador de registro no asigna un rol y la columna users.role por defecto es Admin, lo que permite el acceso a credenciales de dispositivos almacenadas, datos de usuario y emisi\u00f3n de tokens de API."}], "id": "CVE-2026-77915", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77915", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T16:07:58.990479Z", "version": "2.0.3"}}]}, "published": "2026-08-24T17:18:18.450", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/rconfig/rconfig/releases#release-core-8.2.10"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/rconfig/rconfig/security/advisories/GHSA-w3hx-9cxg-5ccr"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/rconfig-unauthorized-admin-registration-via-web-php"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-1188"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.2.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rconfig", "source": "cna", "vendor": "rconfig"}, "product": "rconfig", "vendor": "rconfig"}], "created": "2026-08-24T17:45:03.611010+00:00", "updated": "2026-08-29T14:00:07.524050+00:00", "vendors": ["rconfig", "rconfig$PRODUCT$rconfig"]}