rConfig Auth Bypass Grants Unauthenticated Admin Access

Authentication bypass. No credentials required. Unauthenticated visitors can self-register accounts with full Administrator privileges on rConfig 8.0.0 through 8.2.12.

CVE-2026-77915. CVSS 9.8. Critical. Patched: rConfig 8.2.13. Patch is out now — get it.

The mechanism: A routing configuration error in the application’s routes/web.php re-enables the user registration endpoint after the application explicitly disabled it. The registration controller does not assign a default role, so new accounts receive Administrator access automatically. One unauthenticated HTTP request creates a full-admin account — no prior access, no social engineering required. (Source: NVD.)

What admin access means here: rConfig is a network configuration management platform used by administrators to back up, version-control, and deploy configurations across routers and switches at scale. Administrator access means read/write access to every managed device configuration, stored credentials, and the ability to push configuration changes across the entire managed network. If an attacker registers an admin account, the blast radius is everything rConfig manages.

Also patched in 8.2.13: CVE-2026-77914 — CVSS 6.5 (Medium). Authenticated path traversal in the export download endpoint: crafted filenames with directory traversal sequences allow an authenticated user to read arbitrary files accessible to the rConfig process. Authenticated means you need an account — but if CVE-2026-77915 is present on the same instance, that bar is zero.

Exploitation status: No confirmed in-the-wild exploitation at time of publication. CISA KEV: not listed. The vulnerability’s technical details are publicly available through NVD. History shows unauthenticated admin-takeover bugs get exploited quickly once awareness spreads. Treat patching as urgent.

What to do:

1. Upgrade to rConfig 8.2.13 immediately. Patch is available at the official release page.
2. Restrict access if immediate patching is not possible. rConfig’s web interface should never be directly reachable from the public internet. Restrict it to trusted management VLANs or internal networks behind a firewall. No external access, no exploit path for CVE-2026-77915.
3. Audit administrator accounts. If your rConfig instance was internet-accessible and unpatched, audit user accounts for unexpected administrator entries. Any unrecognized admin account should be treated as attacker-created. Rotate all credentials stored in rConfig for managed devices.

Not patching a CVSS 9.8 admin auth bypass when the fix is available — that’s a choice, not bad luck.

Related coverage:

• Velociraptor Flaw Lets Analysts Overwrite Artifacts — another critical security tool vulnerability
• Zimbra SNMP RCE Now Exploited in the Wild — CISA KEV, network software targeted
• strongSwan 6.0.7 Patches Double-Free in IKE Auth — critical networking auth flaw