CVE-2026-109567: Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rapyd Adminto a version that resolves this vulnerability.Fixed in 9.20.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any user with the edit users permission can exploit it. This includes users assigned roles such as the shipped operator role if that role has the permission.
What does an attacker need to do to gain administrator access?
The attacker must be authenticated and able to use the UsersEdit Livewire component. They can submit the admin role ID for their own account to assign themselves the admin role.
What is the impact after successful exploitation?
The attacker gains the admin role, which lifts tenant scoping and bypasses per-record authorization. They can also impersonate users.
Which releases are affected and what version fixes the issue?
Rapyd Admin versions from 9.0.0 before 9.20.0 are affected. Version 9.20.0 is the referenced fixed release.