Description
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
Published: 2026-10-12
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an improper privilege management flaw in the UsersEdit Livewire component of Rapyd Admin. Users who have the edit users permission can submit the administrator role ID for their own account, lifting tenant scoping, bypassing per‑record authorization, and enabling impersonation. This flaw therefore grants attackers unauthorized administrative capabilities, compromising system integrity and potentially confidentiality.

Affected Systems

Zofe Rapyd Admin (rapyd-admin) versions 9.0.0 through 9.19.x are affected; all releases before 9.20.0 contain the flaw.

Risk and Exploitability

With a CVSS score of 8.6 the vulnerability is classified as high severity. EPSS data is not available and the issue is not listed in CISA’s KEV catalog. Exploitation requires a user that already has the edit users permission—roles such as the shipped operator role can be abused. For an authenticated internal user the attack path is straightforward: use the UsersEdit component to assign the admin role ID to their own account, bypass tenant scoping and authorization, and attain full administrative access.

Generated by OpenCVE AI on October 12, 2026 at 22:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Rapyd Admin to version 9.20.0 or later to apply the patch that removes the privilege escalation flaw.
  • Restrict or remove the edit users permission from non‑admin roles, especially operator or similar roles, to limit the attack surface.
  • Audit existing user accounts for the admin role and remove any accounts that were granted the admin role via this flaw, then re‑assign appropriate roles.

Generated by OpenCVE AI on October 12, 2026 at 22:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Zofe
Zofe rapyd-admin
Vendors & Products Zofe
Zofe rapyd-admin

Mon, 12 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
Title Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Zofe Rapyd-admin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T13:55:31.753Z

Reserved: 2026-10-12T19:27:53.730Z

Link: CVE-2026-109567

cve-icon Vulnrichment

Updated: 2026-10-15T13:55:27.501Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T21:17:13.347

Modified: 2026-10-16T18:25:45.343

Link: CVE-2026-109567

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:24:57Z

Weaknesses
  • CWE-269

    Improper Privilege Management