Description
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
Published: 2026-10-12
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an improper privilege management flaw in the UsersEdit Livewire component of Rapyd Admin. Users who have the edit users permission can submit the administrator role ID for their own account, lifting tenant scoping, bypassing per‑record authorization, and enabling impersonation. This flaw therefore grants attackers unauthorized administrative capabilities, compromising system integrity and potentially confidentiality.

Affected Systems

Zofe Rapyd Admin (rapyd-admin) versions 9.0.0 through 9.19.x are affected; all releases before 9.20.0 contain the flaw.

Risk and Exploitability

With a CVSS score of 8.6 the vulnerability is classified as high severity. EPSS data is not available and the issue is not listed in CISA’s KEV catalog. Exploitation requires a user that already has the edit users permission—roles such as the shipped operator role can be abused. For an authenticated internal user the attack path is straightforward: use the UsersEdit component to assign the admin role ID to their own account, bypass tenant scoping and authorization, and attain full administrative access.

Generated by OpenCVE AI on October 12, 2026 at 22:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Rapyd Admin to version 9.20.0 or later to apply the patch that removes the privilege escalation flaw.
  • Restrict or remove the edit users permission from non‑admin roles, especially operator or similar roles, to limit the attack surface.
  • Audit existing user accounts for the admin role and remove any accounts that were granted the admin role via this flaw, then re‑assign appropriate roles.

Generated by OpenCVE AI on October 12, 2026 at 22:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
Title Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-12T20:55:20.456Z

Reserved: 2026-10-12T19:27:53.730Z

Link: CVE-2026-109567

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T21:17:13.347

Modified: 2026-10-12T21:17:13.347

Link: CVE-2026-109567

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T22:45:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management