CVE-2026-63102

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-63102

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63102.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-63102

Published

2026-07-20T15:31:17.648Z

Modified

2026-07-28T03:55:55.242557678Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

rConfig Core < 8.2.8 Privilege Escalation via Users API role field

Details

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist validation and absent admin-level authorization check in StoreUserRequest to mass-assign the Admin role directly to the User model, granting access to privileged features. rConfig Pro and Enterprise are not affected.

Database specific

{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63102.json",
    "cwe_ids": [
        "CWE-915"
    ]
}

References

Affected packages

Git / github.com/rconfig/rconfig

Affected ranges

Type

GIT

Repo

https://github.com/rconfig/rconfig

Events

Introduced

Fixed

63bfd1b0086901430ba0642e3f74e3c17caa92a5

Fixed

84822f4051ed97d651b1b4d191c6da2aa8c3c037

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.2.8"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

core-8.*

core-8.0.0

core-8.0.1

core-8.0.2

core-8.1.0

core-8.1.1

core-8.1.2

core-8.1.3

core-8.2.0

core-8.2.3

core-8.2.4

core-8.2.5

core-8.2.6

core-8.2.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63102.json"