Description

rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-24T17:18:18.450Z",
  "pubdate": "2026-08-24T17:18:18.450Z",
  "executiveSummary": "rConfig versions 8.0.0 before 8.2.13 suffer from a critical authentication bypass vulnerability stemming from a routing misconfiguration.\nThe vulnerability allows unauthenticated remote attackers to self-register new user accounts with full Administrator privileges.\nThe flaw exists due to a duplicate bare Auth::routes() call within the routing definitions, which inadvertently re-enables the POST /register endpoint after it was intentionally disabled.\nFurthermore, the registration controller fails to assign an explicit role during account creation, coupled with a database schema design where the users.role column defaults to Admin.\nConsequently, newly registered accounts are immediately authenticated with administrative access upon creation, requiring no prior authentication or specialized privileges.\nSuccessful exploitation grants attackers full administrative control over the affected application, leading to severe risk implications including unauthorized access to stored device credentials, sensitive user data, and the ability to issue API tokens.\nThis represents a complete compromise of confidentiality, integrity, and availability for the targeted rConfig deployment.",
  "technicalDetails": "The root cause of this vulnerability is a routing configuration flaw located in routes/web.php.\nSpecifically, a duplicate bare Auth::routes() method invocation re-enables the POST /register route, overriding prior security controls designed to explicitly disable user registration.\nThe vulnerable component is the Laravel routing mechanism and the associated registration controller within rConfig 8.0.0 through 8.2.12.\nAttackers can interact with the network-exposed application without any authentication or prerequisite privileges.\nThe attack flow proceeds as follows: an unauthenticated attacker sends a crafted HTTP POST request directly to the exposed POST /register endpoint.\nBecause the registration endpoint is improperly active, the application processes the registration payload.\nThe registration controller creates the new user record in the backend database but fails to explicitly assign a user role during the instantiation process.\nDue to the underlying database schema configuration where the users.role column defaults to Admin, the newly created account automatically inherits full administrative privileges.\nUpon successful execution of the registration request, the application immediately issues an authenticated session context for the newly created attacker-controlled account.\nPost-exploitation impact is catastrophic, as the attacker gains immediate access to administrative functionality.\nThis grants the attacker the ability to view and harvest stored device credentials, access sensitive user data, and generate API tokens for persistent access across the target environment."
}