Rapyd Admin: Privilege escalation to admin role via UsersEdit component
Summary
Rapyd Admin from 9.0.0 before 9.20.0 lets a user with the edit-users permission assign the admin role to their own account by submitting the admin role ID in the UsersEdit Livewire component. According to the CVE description, the shipped operator role is sufficient for this. A successful attacker can lift tenant scoping, bypass per-record authorization and impersonate other users.
Affected
- zofe Rapyd Admin 9.0.0 to before 9.20.0 (up to 9.19.x)
Fixed in
- Upgrade to Rapyd Admin 9.20.0 or later (9.20.0 is listed as unaffected).
Workaround
- Unknown. The CVE record gives no workaround; upgrading is the fix.
Exploitation
- CISA KEV: not listed.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No source reports exploitation in the wild.
- A public proof-of-concept repository exists (not reviewed by us).
Our recommendation
- Find all installations that include zofe/rapyd-admin (check composer.lock) and upgrade to 9.20.0 or later.
- Change or delete the admin@laravel account, even if it is not known to be present.
- Audit users with the admin role and review role changes since 9.0.0.
- Limit the edit-users permission to trusted staff and restrict admin panel access to VPN or IP allow-lists.
- Monitor for unexpected role changes and new admin accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Rapyd Admin GitHub repository github.com
- Vulnerable code UsersEdit.php (v9.19.0) github.com
- Patch commit github.com
- Release v9.20.0 github.com
- VulnCheck advisory www.vulncheck.com
- OpenCVE CVE-2026-109567 app.opencve.io
- VulDB 417247 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:38.
Original description (NVD)
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
NVD references (5)
- https://github.com/zofe/rapyd-admin
- https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Auth/Livewire/UsersEdit.php#L119-L121
- https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a
- https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0
- https://www.vulncheck.com/advisories/rapyd-admin-from-9.0.0-before-9.20.0-privilege-escalation-via-usersedit-…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.