Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Rapyd Admin lets certain users grant themselves admin rights

CVE-2026-109567 · published 1 day ago
Summary

The Rapyd Admin tool (versions 9.0.0 through 9.19.x) has a flaw in its user‑editing feature that lets someone with basic edit permissions assign the admin role to their own account. This can give them full control over the system, bypassing normal security checks and allowing them to act as any user. Update to the latest version of Rapyd Admin as soon as possible to close the gap.

What to do
  • Update zofe rapyd-admin to version 9.20.0 or later.
Affected software
VendorProductAffected versions
zofe rapyd-admin < 9.20.0
Original advisory text
Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published12 Oct 2026
Updated14 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109567 · NVD
CVE-2026-109567 · MITRE
CVE-2026-109567 · OSV
Track software like this
Free during beta