CVE-2026-110238 — Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete …
Published: 2026-10-13 · CVSS: 8.7 · CVSS 4.0
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7