rConfig Authentication Bypass — Unauthenticated Admin Registration
rConfig 8.0.0–8.2.12 routing error re-enables user registration, granting unauthenticated callers full Administrator privileges. Patched in 8.2.13.
- Vendor
- rConfig
- Product
- rConfig
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.8%
- Status
- patched
- Published
Is CVE-2026-77915 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-77915 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.8% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
CVE-2026-77915 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Authentication bypass in rConfig’s routing layer. A secondary routing call inadvertently re-enables the POST /register endpoint after the application had explicitly disabled it. The registration controller does not assign a default role, so the users.role column defaults to Administrator. Result: any unauthenticated HTTP request to the registration endpoint creates a fully privileged admin account.
Affected versions: rConfig 8.0.0 through 8.2.12.
Patch: Upgrade to rConfig 8.2.13. Available at the rConfig releases page.
Also patched in 8.2.13: CVE-2026-77914 — CVSS 6.5 path traversal allowing authenticated users to read arbitrary files via crafted export filenames.
Exploitation status: No confirmed in-the-wild exploitation at publication. CISA KEV: not listed. Technical detail is publicly available via NVD. Treat as urgent.
Interim mitigation (if patching is not immediately possible): Restrict rConfig’s web interface to trusted internal network segments. Prevent external access entirely. Also audit Administrator accounts for unexpected entries — if CVE-2026-77915 was reachable before patching, assume any unrecognized admin account was attacker-created.
See full coverage: rConfig Auth Bypass Grants Unauthenticated Admin Access
Other rConfig CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-77914 rConfig Path Traversal — Arbitrary File Read via Export Filenamewrite-up | [ MEDIUM ] | 6.5 | 0.7% | — |
| CVE-2020-10221 rConfig OS Command Injection Vulnerability | [ HIGH ] | 8.8 | 77.1% |
