Manasse

**Name of the Vulnerable Software and Affected Versions** rConfig Core versions prior to 8.2.8 **Description** Authenticated users can escalate privileges by assigning arbitrary roles to any account. This occurs when an unvalidated role field is submitted through the Users API during user creation or profile updates. The issue stems from missing allowlist validation and the absence of admin-level authorization checks in the `StoreUserRequest` function, allowing the Admin role to be mass-assigned directly to the User model. **Recommendations** Update rConfig Core to version 8.2.8 or later. As a temporary mitigation, restrict access to the Users API to prevent unauthorized profile updates or user creation.