Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-110238: Rapyd Admin lets default users change or delete any account
CVE-2026-110238 · published today
Summary
Versions of Rapyd Admin from 9.0.0 up to but not including 9.20.0 let a regular employee with the default customer role edit or remove any user account. This could be used to reset passwords, promote themselves to an owner role, or delete other users. Update Rapyd Admin to version 9.20.0 or later to close the gap.
What to do
- Update zofe rapyd-admin to version 9.20.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zofe | rapyd-admin | < 9.20.0 |
Original advisory text
Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
References
- https://github.com/zofe/rapyd-admin Product
- https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d1614... Patch
- https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0 Vendor Advisory
- https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/... Third Party Advisory
- https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/use... Third Party Advisory
- https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorizati... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1102... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-110238 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta