CVE-2026-77915: 
rConfig vulnerability analysis and mitigation

CVE-2026-77915 is a critical authentication bypass vulnerability in rConfig, a network device configuration management platform, affecting versions 8.0.0 through 8.2.9. The flaw allows unauthenticated remote attackers to self-register accounts that are automatically granted full Administrator privileges. It was published on August 24, 2026, with a patch available in version 8.2.10. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (Github Advisory, rConfig Advisory).

The root cause is a duplicate, unqualified Auth::routes() call in routes/web.php (CWE-306: Missing Authentication for Critical Function; CWE-1188: Insecure Default Initialization of Resource). An earlier call Auth::routes(['register' => false]) explicitly disabled the registration endpoint, but a second bare Auth::routes() call — introduced during multiple SSO provider work in November 2025 — re-registered all default Laravel authentication routes, reinstating the POST /register endpoint. Because Laravel does not deduplicate or retract routes, the later call silently overrode the earlier restriction. Compounding the issue, the registration controller did not assign a role upon account creation, and the users.role database column defaulted to Admin, meaning any newly registered account immediately received full administrative privileges with no invitation, approval, or email verification required (rConfig Advisory, Github Advisory).

Successful exploitation grants an unauthenticated attacker a fully privileged Administrator account on the rConfig instance, with immediate authenticated access upon registration. Because rConfig stores credentials for production network devices, an attacker gains access to those stored device credentials, other users' data, and the ability to issue API tokens — enabling broad lateral movement into managed network infrastructure. The confidentiality, integrity, and availability of the rConfig system and all connected network devices are fully compromised (rConfig Advisory, Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been confirmed as of the disclosure date (Feedly). The vulnerability requires no authentication, no user interaction, and no special preconditions, making it trivially exploitable by any network-accessible attacker. The EPSS score is currently 0.0, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. The vulnerability was assigned by VulnCheck and credited to researcher QwesiRED (rConfig Advisory).

1. Reconnaissance: Identify internet-facing rConfig instances (versions 8.0.0–8.2.9) using tools like Shodan or Censys by searching for rConfig-specific HTTP response headers or login page content.
2. Probe the registration endpoint: Send a GET /register request to the target. A 200 OK response with a registration form confirms the endpoint is active and the instance is likely vulnerable.
3. Submit a registration request: Send a crafted POST /register HTTP request with standard registration fields (name, email, password, password_confirmation) to create a new account. No invitation token or prior authentication is required.
4. Receive Admin session: The registration controller processes the request, creates a user record without assigning a role, and the users.role column defaults to Admin. The response sets an authenticated session cookie with full Administrator privileges.
5. Access sensitive data: Use the Administrator session to browse stored network device credentials, enumerate user accounts, and issue API tokens for persistent programmatic access to the rConfig API and managed devices (rConfig Advisory, Github Advisory).

• Network: Unexpected POST /register HTTP requests to the rConfig web interface from external or unrecognized IP addresses; successful HTTP 200 or 302 responses to those registration requests.
• Logs: Web server access logs showing POST /register from unauthenticated sessions; application logs recording new user creation events outside of normal administrative provisioning workflows.
• Database: Presence of unexpected rows in the users table with role = 'Admin' and is_socialite = 0 that were not provisioned by a known administrator; accounts with recent created_at timestamps not matching any known onboarding activity. Run: SELECT id, name, email, role, is_socialite, created_at FROM users ORDER BY created_at; to audit.
• Application: Unexplained API token issuance events; access to device credential stores or configuration exports by unrecognized user accounts (rConfig Advisory).

The primary fix is to upgrade rConfig to version 8.2.10 or later, which removes the duplicate Auth::routes() call, removes the unused registration controller, and changes the users.role column default from Admin to User. Note that the fix does not retroactively modify existing user rows — administrators must manually audit the users table for unauthorized Admin accounts and treat any stored device credentials as compromised if a rogue account is found. As an immediate workaround for installations that cannot be upgraded, block the /register endpoint at the reverse proxy or load balancer. Further security hardening is available in versions 8.2.13 and 8.2.14, which address additional issues including cleartext credential exposure in the REST API and world-readable configuration files (rConfig Advisory, rConfig Releases).

The vulnerability was reported by researcher QwesiRED and disclosed via the rConfig GitHub security advisory on August 10, 2026, with the CVE published on August 24, 2026. VulnCheck published an advisory and served as the CVE assigner. Community discussion appeared on Reddit's r/pwnhub in a daily CVE brief, and the vulnerability was indexed by Sploitus shortly after disclosure, indicating moderate community interest (rConfig Advisory).