CVE-2026-109565: Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Rapyd Admin installations from version 9.4.0 up to, but not including, 9.20.0 are affected when self-registration is available and an administrator uses the Activity log Author filter. An unauthenticated user can supply a malicious display name during registration.
What does an attacker need to exploit it?
The attacker only needs network access and the ability to self-register with an HTML or JavaScript payload in their display name. Exploitation requires an administrator to view the Activity log Author filter, where the name is rendered without escaping.
What is the practical impact if exploitation succeeds?
The injected script executes in the administrator's browser session. The reported impact includes compromise of confidentiality and integrity within that session, with no availability impact indicated.
What should be done if an immediate upgrade is not possible?
Disable or restrict self-registration so unauthenticated users cannot create accounts with attacker-controlled display names. Avoid using the Activity log Author filter until the affected component can be updated.