CVE-2026-63102
Full vulnerability record from the local CVENow database.
Description
rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features. rConfig Pro and Enterprise are not affected.
Severity
MEDIUM
CVSS score
5.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-20 16:17:06.540000
Last modified
2026-10-24 20:10:00.137000
View original CVE JSON
{
"id": "CVE-2026-63102",
"sourceIdentifier": "[email protected]",
"published": "2026-07-20T16:17:06.540",
"lastModified": "2026-10-24T20:10:00.137",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features. rConfig Pro and Enterprise are not affected."
},
{
"lang": "es",
"value": "rConfig Core antes de la versión 8.2.8 contiene una vulnerabilidad de escalada de privilegios que permite a los usuarios autenticados asignar roles arbitrarios a cualquier cuenta al enviar un campo de rol no validado a través de la API de Usuarios durante la creación de usuarios o las actualizaciones de perfil. Los atacantes pueden explotar la falta de validación de lista de permitidos y la ausencia de una verificación de autorización a nivel de administrador en StoreUserRequest para asignar masivamente el rol de Administrador directamente al modelo de Usuario, otorgando acceso a funciones privilegiadas. rConfig Pro y Enterprise no se ven afectados."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "rConfig",
"product": "rConfig v8 Core",
"defaultStatus": "affected",
"repo": "https://github.com/rconfig/rconfig",
"packageURL": "pkg:github/rconfig/rconfig",
"versions": [
{
"version": "0",
"lessThan": "8.2.8",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-20T19:23:24.335951Z",
"id": "CVE-2026-63102",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-915"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rconfig:rconfig:*:*:*:*:core:*:*:*",
"versionEndExcluding": "8.2.8",
"matchCriteriaId": "1F243ABA-0FC5-4C60-893C-1FB8C770EF4F"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/rconfig/rconfig/commit/84822f4051ed97d651b1b4d191c6da2aa8c3c037",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/rconfig/rconfig/pull/325",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch"
]
},
{
"url": "https://github.com/rconfig/rconfig/releases/tag/core-8.2.8",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://www.vulncheck.com/advisories/rconfig-privilege-escalation-via-users-api-role-field",
"source": "[email protected]",
"tags": [
"Patch",
"Release Notes",
"Third Party Advisory"
]
}
]
}