Privilege Escalation Vulnerability in rConfig Affects User Role Management

CVE-2026-63102

What is CVE-2026-63102?

rConfig versions prior to 8.2.8 are susceptible to a privilege escalation vulnerability. This flaw allows authenticated users to exploit the Users API, granting them the capability to assign arbitrary roles to any account during user account creation or profile updates. By bypassing critical allowlist validation and lacking an essential admin-level authorization check in the StoreUserRequest process, an attacker can gain unauthorized access to privileged features by assigning the Admin role to any user model. This vulnerability poses a significant risk, enabling unauthorized control over user permissions in the application.

References