CVE-2026-109567

Received Received - Intake

Improper Privilege Management in Rapyd Admin

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109567

Affected Vendors & Products

Vendor	Product	Version / Range
zofe	rapyd-admin	9.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

Rapyd Admin versions 9.0.0 to 9.20.0 have an improper privilege management flaw in the UsersEdit Livewire component. Users with edit permissions can assign themselves the admin role by submitting the admin role ID. This bypasses tenant scoping and per-record authorization, enabling impersonation and privilege escalation.

Detection Guidance

This vulnerability can be detected by reviewing user role assignments in Rapyd Admin. Check if any non-admin users have been assigned the admin role ID, particularly in the UsersEdit Livewire component. Inspect user permissions and role mappings for unauthorized privilege escalation.

Impact Analysis

Attackers with limited roles like operator can escalate privileges to admin. This allows them to bypass access controls, impersonate other users, and potentially gain full control over the system, leading to data breaches or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using affected versions may face compliance failures, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update Rapyd Admin to version 9.20.0 or later to address the improper privilege management vulnerability in the UsersEdit Livewire component.

Hi! I’m here to help you understand CVE-2026-109567. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70