High severity8.8NVD Advisory· Published Oct 13, 2026· Updated Oct 13, 2026
CVE-2026-110238
CVE-2026-110238
Description
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: 9.0.0 <= v < 9.20.0
- Range: 9.0.0 <= v < 9.20.0
Patches
Vulnerability mechanics
References
5- github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.phpnvd
- github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.phpnvd
- github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406anvd
- github.com/zofe/rapyd-admin/releases/tag/v9.20.0nvd
- www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorization-bypass-via-usersmodaleditembed-componentnvd
News mentions
0No linked articles in our index yet.