CVE-2026-110238
Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
| CWE | CWE-639 |
| Vendor | zofe |
| Product | rapyd-admin |
| Published | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for zofe rapyd-admin
Be the first to know when new high vulnerabilities affecting zofe rapyd-admin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
zofe / rapyd-admin
9.0.0 < 9.20.0
References
github.com: https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a github.com: https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0 github.com: https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php#L27-L81 github.com: https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.php#L17-L20 github.com: https://github.com/zofe/rapyd-admin vulncheck.com: https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorization-bypass-via-usersmodaleditembed-component
Credits
hyderpwn