CVE-2026-110238: Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rapyd Adminto a version that resolves this vulnerability.Fixed in 9.20.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Rapyd Admin versions from 9.0.0 up to, but not including, 9.20.0 are affected. The vulnerable access is available to authenticated company members assigned the default customer role.
What does an attacker need to exploit this issue?
An attacker needs an authenticated account with the default customer role. They can invoke the UsersModalEditEmbed component's editUser or deleteUser actions and use predictable sequential user IDs to target other accounts.
What is the likely impact of a successful exploit?
An attacker can modify or delete arbitrary user accounts. This includes resetting owner or super-admin passwords, promoting their own account to owner, and deleting users.
What should be done if immediate upgrading is not possible?
The provided information does not specify a workaround. Prioritize restricting or removing untrusted customer-role accounts and monitor for unexpected user edits, deletions, password resets, or role changes until upgrading to 9.20.0 or later.