The vulnerability is an authorization bypass through privilege escalation (CWE-1188) and missing authentication (CWE-306). This vulnerability resides in the routing configuration of rConfig 8.0.0 up to 8.2.9. A duplicate bare Auth::routes() call re‑enables a POST /register route that was explicitly disabled, allowing unauthenticated actors to register an account. Because the registration controller does not assign a role and the default users.role column is Admin, the new account is granted full administrative privileges on first login. This gives attackers unrestricted access to device credentials, user data, and the ability to issue API tokens, effectively compromising the entire system and all managed devices.

The affected vendor is rConfig. All rConfig installations running version 8.0.0 through 8.2.9 are vulnerable. Upgrading to rConfig 8.2.10 or later removes the duplicate route and assigns appropriate roles during registration.

The vulnerability exploits an authorization bypass (CWE-1188) and missing authentication (CWE-306), enabling unauthenticated remote attackers to self-register as administrators. The CVSS score of 9.3 indicates critical severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. The vulnerability is feasible from any network where the web interface is reachable, i.e., a remote attack vector inferred from the description. Presence of the full admin grant upon registration makes this a high‑impact scenario, especially if device credentials are stored in the database.