rConfig Authentication Bypass — Unauthenticated Admin Registration

Authentication bypass in rConfig’s routing layer. A secondary routing call inadvertently re-enables the POST /register endpoint after the application had explicitly disabled it. The registration controller does not assign a default role, so the users.role column defaults to Administrator. Result: any unauthenticated HTTP request to the registration endpoint creates a fully privileged admin account.

Affected versions: rConfig 8.0.0 through 8.2.12.

Patch: Upgrade to rConfig 8.2.13. Available at the rConfig releases page.

Also patched in 8.2.13: CVE-2026-77914 — CVSS 6.5 path traversal allowing authenticated users to read arbitrary files via crafted export filenames.

Exploitation status: No confirmed in-the-wild exploitation at publication. CISA KEV: not listed. Technical detail is publicly available via NVD. Treat as urgent.

Interim mitigation (if patching is not immediately possible): Restrict rConfig’s web interface to trusted internal network segments. Prevent external access entirely. Also audit Administrator accounts for unexpected entries — if CVE-2026-77915 was reachable before patching, assume any unrecognized admin account was attacker-created.

See full coverage: rConfig Auth Bypass Grants Unauthenticated Admin Access