CVE-2026-77915 Overview
CVE-2026-77915 is an authentication bypass vulnerability in rConfig Core versions 8.0.0 through 8.2.12. The flaw resides in routes/web.php, where a duplicate bare Auth::routes() call re-enables the POST /register endpoint after it was explicitly disabled. Unauthenticated attackers can self-register accounts that receive full Administrator privileges because the registration controller does not assign a role, and the users.role database column defaults to Admin. Successful exploitation grants immediate access to stored device credentials, user data, and API token issuance. The vulnerability is tracked under CWE-306: Missing Authentication for Critical Function.
Critical Impact
Any network-reachable attacker can register an Administrator account and exfiltrate stored network device credentials without prior authentication.
Affected Products
- rConfig Core 8.0.0 through 8.2.9
- rConfig Core 8.2.10 through 8.2.12
- Fixed in rConfig Core 8.2.13
Discovery Timeline
- 2026-08-24 - CVE-2026-77915 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77915
Vulnerability Analysis
rConfig is a network device configuration management application built on the Laravel framework. Laravel exposes the Auth::routes() helper to register authentication endpoints, including POST /register. rConfig maintainers disabled public registration by passing ['register' => false] to a scoped Auth::routes() call. A second, unscoped Auth::routes() invocation later in routes/web.php overrode that restriction and re-registered the POST /register route with default parameters.
When the registration handler creates the new user record, it omits the role field. The users.role column carries a database default of Admin, so any account created through this path is persisted with administrative privileges. Laravel's default registration controller also authenticates the new user immediately, granting the attacker an active Administrator session on the first request.
Root Cause
The root cause is a route configuration error compounded by an insecure database default. The duplicate Auth::routes() call reintroduces the disabled endpoint, and the missing role assignment in RegisterController allows the default Admin value to take effect. Neither layer enforces authentication or authorization on account creation.
Attack Vector
Exploitation requires only network access to the rConfig web interface. An attacker submits a standard registration form to POST /register with a chosen name, email, and password. The application creates the Administrator account, establishes a session, and returns an authenticated response. From there, the attacker can retrieve stored SSH and SNMP credentials for managed network devices, download configuration backups, and mint API tokens for persistent access. Full technical details are available in the GitHub Security Advisory GHSA-w3hx-9cxg-5ccr and the VulnCheck advisory.
Detection Methods for CVE-2026-77915
Indicators of Compromise
- Unexpected POST /register requests in web server access logs from external or non-administrative source addresses.
- New rows in the users table with role = Admin and creation timestamps not tied to a change ticket.
- Newly issued API tokens or unexplained device configuration downloads following account creation events.
- Session activity from IP addresses that have never previously authenticated to rConfig.
Detection Strategies
- Review Laravel application logs and web server access logs for any successful HTTP 200 or 302 response to POST /register.
- Query the users table for accounts created after deployment of an affected version and validate each against approved change records.
- Correlate registration events with subsequent access to device credential and configuration endpoints.
Monitoring Recommendations
- Alert on any HTTP request to /register on rConfig hosts, since legitimate registration should be disabled.
- Track outbound API token creation and device configuration export volume for anomalous spikes.
- Forward rConfig web and database audit logs to a centralized SIEM for retention and correlation.
How to Mitigate CVE-2026-77915
Immediate Actions Required
- Upgrade rConfig Core to version 8.2.13 or later without delay.
- Audit the users table and remove any Administrator accounts that cannot be tied to an authorized administrator.
- Rotate all stored device credentials, SSH keys, SNMP community strings, and API tokens managed by the affected rConfig instance.
- Restrict network access to the rConfig web interface to trusted management networks until patching is complete.
Patch Information
The vendor addressed the vulnerability in rConfig Core 8.2.13 by removing the duplicate Auth::routes() call and ensuring the registration endpoint remains disabled. Refer to the rConfig GitHub release notes and the GitHub Security Advisory GHSA-w3hx-9cxg-5ccr for upgrade guidance.
Workarounds
- If immediate patching is not possible, remove the duplicate bare Auth::routes() line from routes/web.php so registration remains disabled.
- Change the database default for users.role from Admin to a low-privilege value such as User.
- Block POST /register at an upstream reverse proxy or web application firewall.
- Place rConfig behind a VPN or bastion host to eliminate direct internet exposure of the web interface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
