CVE-2026-109567
HighCVSS 7.2Summary
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
Risk Assessment
An attacker can elevate their privileges to admin, gaining access to other tenants' data and the ability to impersonate other users.
Recommendation
Update Rapyd Admin to version 9.20.0 or later and restrict the ability to assign administrative roles to authorised administrators only.
Other vulnerabilities in Rapyd Admin
See all- CVE-2026-109565Medium
Rapyd Admin from version 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
- CVE-2026-109566Critical
Rapyd Admin versions 9.0.0 before 9.20.0 contain hard-coded credentials that allow remote unauthenticated attackers to gain super-admin access through an admin@laravel account with password admin. The account is seeded by the installer and silently re-created on every rpd:make run, bypassing authorization and tenant scoping.
Original NVD description (English source)
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS