CVE-2026-110238— Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
Quick assessment
Affected
zofe rapyd-admin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Rapyd Admin 版本在 9.0.0 至 9.20.0（不含 9.20.0）之间存在一个授权绕过漏洞。该漏洞允许以默认“客户”角色身份认证的公司成员，通过 UsersModalEditEmbed Livewire 组件修改或删除任意用户账户。攻击者可以利用可预测的连续用户 ID，调用 editUser 或 deleteUser 操作，从而重置所有者或超级管理员的密码、将自己提升为所有者，并删除其他用户。
Possible ATT&CK Techniques 1 AI
T1136.001 · Local AccountAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| zofe | rapyd-admin | 9.0.0< 9.20.0 |
affected |
9.20.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110238
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
Source: CVE Program / CVE List V5
Vulnerability Description
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zofe | rapyd-admin | 9.0.0 ~ 9.20.0 | - |
|
II. Public POCs for CVE-2026-110238
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110238
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-110238 (2)
Vendor Advisories for CVE-2026-110238 (1)
Vendor Pages for CVE-2026-110238 (1)
Other References for CVE-2026-110238 (1)
IV. Related Vulnerabilities
Same product: rapyd-admin
-
CVE-2026-110239
Rapyd Admin before 9.20.0 Stored XSS via rich-text Component -
CVE-2026-109566
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Crede -
CVE-2026-109567
Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation vi -
CVE-2026-109565
Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list C
Same vendor: zofe
-
CVE-2026-110239
Rapyd Admin before 9.20.0 Stored XSS via rich-text Component -
CVE-2026-109566
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Crede -
CVE-2026-109567
Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation vi -
CVE-2026-109565
Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list C
Same weakness: CWE-639
-
CVE-2026-103366
Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object -
CVE-2026-110467
WisdomGarden｜Tronclass - Insecure Direct Object Reference -
CVE-2026-110465
WisdomGarden｜Tronclass - Insecure Direct Object Reference -
CVE-2026-97657
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticat -
CVE-2026-107652
Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated
V. Comments for CVE-2026-110238
No comments yet