CyberRota Analysis
AI-GeneratedAuthenticated users of rConfig Core versions prior to 8.2.8 are vulnerable to a privilege escalation flaw that allows them to assign arbitrary roles, including Admin, to any account via the Users API. This vulnerability arises from inadequate validation and authorization checks during user creation or profile updates, potentially leading to unauthorized access to sensitive features. Organizations using rConfig Core should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features. rConfig Pro and Enterprise are not affected.