{"id":"CVE-2026-110238","published":"2026-10-13T19:18:49.063","lastModified":"2026-10-14T17:18:24.920","description":"Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/zofe/rapyd-admin","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php#L27-L81","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.php#L17-L20","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0","tags":[]},{"url":"https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorization-bypass-via-usersmodaleditembed-component","tags":[]}],"exploitRefs":[{"url":"https://github.com/zofe/rapyd-admin","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php#L27-L81","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.php#L17-L20","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0","tags":[]}],"hasPoc":true,"ai":{"summary":"A vulnerability in Rapyd Admin allows authenticated users with default customer roles to bypass authorization and modify or delete any user account, potentially enabling attackers to reset admin passwords, promote themselves to owner, or delete users.","exploitability":"The exploit is straightforward requiring only authentication as a company member with the default customer role, and predictable sequential user IDs to dispatch editUser or deleteUser commands.","blast_radius":"The impact could be significant as attackers can gain full administrative control by resetting owner or super admin passwords and deleting key users, affecting the entire application's integrity and access control.","remediation":"Upgrade to version 9.20.0 or later to address the authorization bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authorization","bypass","admin","livewire"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:53:58.235Z"}}