CVE-2026-109565
MediumCVSS 6.1Summary
Rapyd Admin from version 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
Risk Assessment
The risk includes the possibility of hijacking an administrator's session and performing malicious actions with administrator privileges, potentially leading to system integrity compromise.
Recommendation
It is recommended to upgrade Rapyd Admin to version 9.20.0 or later and implement input validation and escaping.
Other vulnerabilities in Rapyd Admin
See all- CVE-2026-109567High
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
- CVE-2026-109566Critical
Rapyd Admin versions 9.0.0 before 9.20.0 contain hard-coded credentials that allow remote unauthenticated attackers to gain super-admin access through an admin@laravel account with password admin. The account is seeded by the installer and silently re-created on every rpd:make run, bypassing authorization and tenant scoping.
Original NVD description (English source)
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS