Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-110238Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component

High 8.8

In plain English

A high-severity authorization bypass via user-controlled key in rapyd-admin from zofe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 60.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.

Affected products (as reported)

Vendor	Product	Versions
zofe	rapyd-admin	9.0.0 – before 9.20.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Patch Commit patch
rapyd-admin v9.20.0 Release Notes release-notes
Vulnerable code in UsersModalEditEmbed.php technical-description
Member id dispatches in users_table_embed.blade.php technical-description
https://github.com/zofe/rapyd-admin product
VulnCheck Advisory: Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component third-party-advisory