rConfig Core versions earlier than 8.2.8 contain a flaw that permits authenticated users to assign any role to any account via the Users API. The lacking allow‑list validation and missing admin‑level authorization checks in StoreUserRequest enable mass‑assignment of the Admin role. This flaw elevates a normal user to a privileged account, granting access to features reserved for administrators and undermining the system’s integrity and confidentiality.

The vulnerability affects rConfig rConfig Core v8 prior to 8.2.8. Versions rConfig Pro and Enterprise are not impacted. Any deployment of Core before the 8.2.8 release that allows user creation or profile updates through the public API is vulnerable.

The CVSS score of 5.3 indicates a moderate risk. The EPSS score below 1% suggests that exploitation is unlikely, but the vulnerability still poses a threat if an attacker gains access to a legitimate user account. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the missing allow‑list validation and absent admin‑level authorization in StoreUserRequest, submitting an arbitrary role value through the Users API for user creation or profile updates. With valid credentials, an attacker can assign the Admin role to any account, elevating privileges across the system.