A duplicate route declaration in rConfig re-enables a disabled registration endpoint, letting any unauthenticated attacker create an account that lands with full Administrator privileges.
What Is It
CVE-2026-77915 is an authentication bypass in rConfig, the network device configuration management platform. The root cause is a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it had been explicitly disabled elsewhere in the file.
The impact is compounded by a second flaw: the registration controller does not assign a role to newly created accounts, and the users.role column defaults to Admin. An attacker who reaches the re-enabled endpoint registers an account, is immediately authenticated, and holds Admin-level access with no further exploitation required.
VulnCheck, the disclosing party, rates it CVSS 3.1 base score 9.8 (CRITICAL), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a CVSS 4.0 score of 9.3. It is tracked as CWE-306 (Missing Authentication for Critical Function) and CWE-1188 (Insecure Default Initialization of Resource).
Why It Matters
There is no authentication, no user interaction, and no privilege prerequisite. Attack complexity is low and the attack vector is network-based; a single HTTP POST is the entire exploit chain.
Post-registration, an Admin account in rConfig exposes stored device credentials, user data, and the ability to issue API tokens. Because rConfig sits on network infrastructure and holds credentials for the devices it manages, an Admin compromise is effectively a credential harvest against the managed device fleet.
No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation or federal remediation deadline in the source material.
What's Vulnerable
rConfig versions 8.0.0 up to (but not including) 8.2.13 per the CVE description. Note a discrepancy in the supplied NVD record: the structured affected-version data lists 8.0.0 to <8.2.10, while the text description states before 8.2.13. Treat 8.2.13 as the safe floor.
Patch Status
Upgrade to a fixed release from the rConfig GitHub releases page. Given the version discrepancy above, upgrading to 8.2.13 or later is the conservative action. The record was published 2026-08-24 with a status of Received, meaning NVD analysis is not yet complete. No mitigations beyond patching are described in the supplied material.
Sources
- NVD, CVE-2026-77915: https://nvd.nist.gov/vuln/detail/CVE-2026-77915
- rConfig GitHub Security Advisory (GHSA-w3hx-9cxg-5ccr): https://github.com/rconfig/rconfig/security/advisories/GHSA-w3hx-9cxg-5ccr
- VulnCheck Advisory: https://www.vulncheck.com/advisories/rconfig-unauthorized-admin-registration-via-web-php
- rConfig Releases: https://github.com/rconfig/rconfig/releases#release-core-8.2.10