CVE-2026-63102 is a privilege escalation vulnerability in rConfig Core before version 8.2.8. Authenticated users can exploit the lack of allowlist validation on the role field and the absence of an admin-level authorization check in the StoreUserRequest process. By submitting an unvalidated role value through the Users API during user creation or profile updates, attackers can assign themselves or others the Admin role, thereby gaining unauthorized privileged access. This vulnerability does not affect rConfig Pro or Enterprise editions.

The vulnerability allows authenticated users to escalate privileges by assigning themselves or other accounts the Admin role without proper authorization. This grants access to privileged features that should be restricted, potentially leading to unauthorized configuration changes or administrative actions within rConfig Core environments running affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Users API to trusted administrators only and monitor for suspicious role assignment activities. Avoid using affected versions of rConfig Core in untrusted environments.