CVE-2026-110238: falha de alta gravidade em zofe rapyd-admin
Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.5%
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
zofe · rapyd-adminCVEs relacionadas — zofe rapyd-admin
No mesmo produto, das mais perigosas para as menos.
CVE-2026-109566CRITICALRapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeederEPSS 0.4%CVE-2026-109567HIGHRapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit ComponentEPSS 0.3%CVE-2026-110239LOWRapyd Admin before 9.20.0 Stored XSS via rich-text ComponentEPSS 0.2%CVE-2026-109565MEDIUMRapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list ComponentEPSS 0.2%
Referências
https://github.com/zofe/rapyd-adminhttps://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php#L27-L81https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.php#L17-L20https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406ahttps://github.com/zofe/rapyd-admin/releases/tag/v9.20.0https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorization-bypass-via-usersmodaleditembed-component