Authorization Bypass Vulnerability in Rapyd Admin by Zofe
CVE-2026-110238

8.7HIGH

Key Information:

Vendor

Zofe

Status
Rapyd-admin
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110238?

Rapyd Admin versions 9.0.0 to 9.19.0 are susceptible to an authorization bypass vulnerability. This flaw enables authenticated users with the default customer role to manipulate or erase user accounts using the UsersModalEditEmbed Livewire component. Attackers can exploit this weakness by issuing editUser or deleteUser commands with sequential user IDs, potentially resetting owner or super admin passwords, promoting themselves to owner, or even deleting other users. Immediate patching is recommended to ensure the security of user accounts.

Affected Version(s)

rapyd-admin 9.0.0 < 9.20.0

rapyd-admin 9.20.0

References

https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5cc...
patch
https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0
release-notes
https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modu...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hyderpwn
.