Improper Privilege Management Vulnerability in Rapyd Admin

CVE-2026-109567

What is CVE-2026-109567?

A vulnerability in Rapyd Admin prior to version 9.20.0 allows users with the 'edit users' permission to escalate their privileges by assigning the admin role to their own account. This flaw resides in the UsersEdit Livewire component, enabling attackers with lower privileges, such as the operator role, to manipulate their role by submitting the admin role ID. This compromises tenant scoping and circumvents per-record authorization, potentially resulting in impersonation and unauthorized access.

References