What’s Vulnerable › Vulnerabilities

CVE-2026-110238: Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-14
• Weakness: CWE-639

Description

Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.

Affected products

• zofe rapyd-admin: from 9.0.0 before 9.20.0 — fixed in 9.20.0

How to fix

Upgrade to a fixed version: zofe rapyd-admin 9.20.0. Check the vendor advisory for mitigations.

References

• https://github.com/zofe/rapyd-admin
• https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php#L27-L81
• https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.php#L17-L20
• https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a
• https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0
• https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorization-bypass-via-usersmodaleditembed-component

Get alerted when CVE-2026-110238 or the next vulnerability affects your stack