rConfig CVE-2026-63102

The attacker must possess a valid authenticated session on the rConfig instance with at least a low-privilege (non-Admin) user account - this is the sole prerequisite. No special configuration, non-default settings, or specific deployment mode is required; the vulnerable Users API endpoint (user creation and profile update) is standard rConfig functionality active in all pre-8.2.8 deployments. The key limiting factor is the need for prior authentication (CVSS PR:L): unauthenticated remote attackers cannot exploit this directly without first obtaining valid credentials through other means. There is no documented dependency on operating system, database backend, or specific rConfig feature toggle.

The provided CVSS 4.0 vector scores this at 5.3 (Medium) with VC:L/VI:L/VA:N, which materially underrepresents the practical impact: gaining the Admin role in a network configuration management tool grants the ability to push configuration changes to managed network devices, a capability that far exceeds low integrity impact. The attack vector (AV:N/AC:L/PR:L/UI:N) confirms the flaw is network-reachable, trivially exploitable, and requires no special attack conditions - only a valid authenticated session, making it fully automatable. No EPSS data was provided in the input and no CISA KEV listing exists, so confirmed active exploitation is absent at the time of analysis. No public POC has been identified. The primary limiting factor is the requirement for a pre-existing authenticated account (PR:L), which bounds exploitation to insider threats, compromised credentials, or environments with self-registration enabled. In environments where rConfig is used to manage critical network infrastructure and where authenticated access is broadly granted, this should be treated as a high-priority remediation item despite the moderate nominal CVSS score.

An attacker with a standard low-privilege rConfig account sends a crafted HTTP POST or PUT request to the Users API - either during account creation or a profile update - supplying a role parameter value of Admin. Because StoreUserRequest applies no allowlist check and no authorization verification, the server silently accepts the assignment and elevates the account. The attacker then accesses Admin-restricted rConfig features, including the ability to view, modify, and deploy configurations to managed network devices.