Is there a patch available for CVE-2026-63102?

Yes, a patch is available for CVE-2026-63102. Update the affected software to the latest version immediately.

rConfig CVE-2026-63102

Q: What is the CVSS score of CVE-2026-63102?

CVE-2026-63102 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45979 MEDIUM

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-07-20 VulnCheck

GHSA-h4rq-p45c-642r

Privilege Escalation Rconfig

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-accessible API with PR:L since a valid account is required; integrity is High because unrestricted role promotion grants full Admin control over the application.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 20, 2026 - 18:14 vuln.today

Analysis Generated

Jul 20, 2026 - 18:14 vuln.today

DescriptionCVE.org

rConfig before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features.

AnalysisAI

Privilege escalation in rConfig before 8.2.8 allows any authenticated low-privilege user to self-assign or assign the Admin role to arbitrary accounts via a missing allowlist and absent authorization check in the Users API. The StoreUserRequest handler accepts a caller-supplied role field without validating it against permitted values and without verifying the requesting account already holds Admin status, enabling direct mass-assignment of the Admin role to any user model during creation or profile updates. No public exploit code has been identified and CISA KEV listing is absent; a vendor-released patch is available in version 8.2.8.

Technical ContextAI

rConfig is a network device configuration management platform used to automate backup, comparison, and deployment of device configurations. The flaw is rooted in CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), commonly called mass assignment - a class of vulnerability where a model accepts untrusted HTTP input fields that map directly onto internal object properties without restriction. Specifically, the StoreUserRequest class, responsible for validating both user creation and profile update API requests, failed to enforce an allowlist on the role parameter, allowing any authenticated caller to supply an arbitrary role string. A second independent control failure - the absence of an admin-level authorization gate - meant that even if allowlist validation were bypassed, no privilege check blocked non-Admin accounts from escalating themselves or others. Affected scope per CPE: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:* (all versions prior to 8.2.8). The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N confirms the attack is network-reachable, low-complexity, and requires no user interaction beyond a valid low-privilege session.

RemediationAI

Upgrade to rConfig V8 Core 8.2.8 or later, which introduces two independent fixes: the role field in StoreUserRequest now validates against a fixed allowlist of permitted values, and assigning the Admin role now requires the acting account to already hold Admin status (https://github.com/rconfig/rconfig/releases/tag/core-8.2.8). The precise fix is contained in commit 84822f4051ed97d651b1b4d191c6da2aa8c3c037, merged via pull request #325. If immediate upgrade is not feasible, restrict network-layer or middleware-level access to the Users API POST and PUT endpoints so that only accounts with confirmed Admin privileges can call them - accepting the trade-off that this will block legitimate non-Admin self-service profile updates until the patch is applied. Disabling self-service user registration, if enabled, reduces the pool of potential attackers to those with already-issued credentials.