---
id: CVE-2026-110238
title: >-
  Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass
  vulnerability that allows authenticated company members with the default
  customer role to modify or delete arbitrary user accounts through the
  UsersModalEditEmbed Live…
summary: >-
  Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass
  vulnerability that allows authenticated company members with the default
  customer role to modify or delete arbitrary user accounts through the
  UsersModalEditEmbed Live…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-639
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T19:30:29.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110238'
references:
  - url: 'https://github.com/zofe/rapyd-admin'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php#L27-L81
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.php#L17-L20
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a
    label: disclosure@vulncheck.com
  - url: 'https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorization-bypass-via-usersmodaleditembed-component
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T19:43:28.943Z'
---

## Overview

Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.