PT-2026-61621 · Unknown · Rconfig Core

Manasse + 1 · CVE-2026-63102 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions rConfig Core versions prior to 8.2.8

Description Authenticated users can escalate privileges by assigning arbitrary roles to any account. This occurs when an unvalidated role field is submitted through the Users API during user creation or profile updates. The issue stems from missing allowlist validation and the absence of admin-level authorization checks in the StoreUserRequest function, allowing the Admin role to be mass-assigned directly to the User model.

Recommendations Update rConfig Core to version 8.2.8 or later. As a temporary mitigation, restrict access to the Users API to prevent unauthorized profile updates or user creation.

Fix

LPE

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-63102

Affected Products

Rconfig Core

References · 6

• https://github.com/rconfig/rconfig/commit/84822f4051ed97d651b1b4d191c6da2aa8c3c037 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-63102 · Security Note
• https://github.com/rconfig/rconfig/releases/tag/core-8.2.8 · Note
• https://github.com/rconfig/rconfig/pull/325 · Note
• https://twitter.com/CVEnew/status/2079238915345572206 · Twitter Post
• https://vulncheck.com/advisories/rconfig-privilege-escalation-via-users-api-role-field · Note