rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features. rConfig Pro and Enterprise are not affected.
References
Configurations
No configuration.
History
20 Jul 2026, 17:18
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features. rConfig Pro and Enterprise are not affected. |
20 Jul 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-20 16:17
Updated : 2026-07-23 15:25
NVD link : CVE-2026-63102
Mitre link : CVE-2026-63102
CVE.ORG link : CVE-2026-63102
JSON object : View
Products Affected
No product.
CWE
CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes