Authorization Bypass in Rapyd Admin Allows User Manipulation

Executive Summary

This vulnerability is an authorization bypass in Rapyd Admin versions 9.0.0 to 9.19.0. It allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can exploit predictable sequential user IDs to reset owner or super admin passwords, promote themselves to owner, and delete users due to improper authorization checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Rapyd Admin version is between 9.0.0 and 9.19.0. Run: composer show zofe/rapyd-admin to verify the installed version. Inspect network traffic for unauthorized editUser or deleteUser actions dispatched via the UsersModalEditEmbed component.

Useful 0 Not Useful 0

Impact Analysis

An attacker could take over admin accounts, escalate their own privileges to owner status, delete critical users, or manipulate user data. This could lead to complete system compromise, data loss, or unauthorized access to sensitive information within the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of personal data, violating GDPR's data protection principles and HIPAA's access controls. It may result in non-compliance with regulations requiring strict user access controls and data integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Rapyd Admin to version 9.20.0 or later. Change the default admin password (admin@laravel) or delete the account. Review user roles and permissions to ensure no unauthorized privilege escalations occurred.

Useful 0 Not Useful 0