HIGH 8.7 NVD
CVE-2026-110238
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
References
- https://github.com/zofe/rapyd-admin
- https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModal
- https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_e
- https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a
- https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-13 via NVD.
vulnfeed aggregates 14602 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.