Description
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
Published: 2026-10-13
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

Rapyd Admin versions 9.0.0 through 9.19.x contain an authorization bypass that lets authenticated company members with the default customer role change or delete any user. The flaw is in the UsersModalEditEmbed Livewire component, allowing callers to send editUser or deleteUser requests with sequential user IDs. Attackers can reset credentials, promote themselves to owners, or remove other accounts.

Affected Systems

The affected product is Rapyd Admin by zofe, versions from 9.0.0 up to but not including 9.20.0. Affected modules include the Companies Livewire UsersModalEditEmbed and the corresponding Blade view used in the user table embed. Any installations running those versions are exposed.

Risk and Exploitability

The vulnerability has a CVSS score of 8.7 and no EPSS score is available, and it is not listed in CISA's KEV catalog. The likely attack vector is web-based, requiring only authentication as a company member with a default customer role. Because the flaw permits arbitrary user modifications, the risk of privilege escalation and data tampering is high. If exploited, attackers could elevate their own role to owner or super admin and compromise application security.

Generated by OpenCVE AI on October 17, 2026 at 05:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Rapyd Admin to version 9.20.0 or later, resolving the authorization bypass.
  • Revoke or restrict the default customer role so it cannot edit or delete user accounts via UsersModalEditEmbed.
  • Enforce role‑based access control to ensure only administrator‑level users can modify or delete accounts and audit any changes.

Generated by OpenCVE AI on October 17, 2026 at 05:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Zofe
Zofe rapyd-admin
Vendors & Products Zofe
Zofe rapyd-admin

Tue, 13 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
Title Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Zofe Rapyd-admin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-14T16:28:15.944Z

Reserved: 2026-10-13T18:00:09.867Z

Link: CVE-2026-110238

cve-icon Vulnrichment

Updated: 2026-10-14T16:28:11.707Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:18:49.063

Modified: 2026-10-14T17:18:24.920

Link: CVE-2026-110238

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T06:00:04Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key