CVE-2026-110238

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110238", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-13T18:00:09.867Z", "datePublished": "2026-10-13T18:50:18.726Z", "dateUpdated": "2026-10-14T16:28:15.944Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-13T18:50:18.726Z"}, "datePublic": "2026-09-28T00:00:00.000Z", "title": "Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component", "descriptions": [{"lang": "en", "value": "Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "affected": [{"vendor": "zofe", "product": "rapyd-admin", "defaultStatus": "unaffected", "versions": [{"version": "9.0.0", "status": "affected", "versionType": "semver", "lessThan": "9.20.0"}, {"version": "9.20.0", "status": "unaffected", "versionType": "semver"}], "packageURL": "pkg:composer/zofe/rapyd-admin", "repo": "https://github.com/zofe/rapyd-admin"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0", "tags": ["release-notes"], "name": "rapyd-admin v9.20.0 Release Notes"}, {"url": "https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php#L27-L81", "tags": ["technical-description"], "name": "Vulnerable code in UsersModalEditEmbed.php"}, {"url": "https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.php#L17-L20", "tags": ["technical-description"], "name": "Member id dispatches in users_table_embed.blade.php"}, {"url": "https://github.com/zofe/rapyd-admin", "tags": ["product"]}, {"name": "VulnCheck Advisory: Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorization-bypass-via-usersmodaleditembed-component"}], "credits": [{"lang": "en", "value": "hyderpwn", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-14T16:27:34.431150Z", "id": "CVE-2026-110238", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T16:28:15.944Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-110238", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-14T16:27:34.431150Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T16:28:11.707Z"}}], "cna": {"title": "Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component", "credits": [{"lang": "en", "type": "finder", "value": "hyderpwn"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/zofe/rapyd-admin", "vendor": "zofe", "product": "rapyd-admin", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.20.0", "versionType": "semver"}, {"status": "unaffected", "version": "9.20.0", "versionType": "semver"}], "packageURL": "pkg:composer/zofe/rapyd-admin", "defaultStatus": "unaffected"}], "datePublic": "2026-09-28T00:00:00.000Z", "references": [{"url": "https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0", "name": "rapyd-admin v9.20.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php#L27-L81", "name": "Vulnerable code in UsersModalEditEmbed.php", "tags": ["technical-description"]}, {"url": "https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.php#L17-L20", "name": "Member id dispatches in users_table_embed.blade.php", "tags": ["technical-description"]}, {"url": "https://github.com/zofe/rapyd-admin", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorization-bypass-via-usersmodaleditembed-component", "name": "VulnCheck Advisory: Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-13T18:50:18.726Z"}}}, "cveMetadata": {"cveId": "CVE-2026-110238", "state": "PUBLISHED", "dateUpdated": "2026-10-14T16:28:15.944Z", "dateReserved": "2026-10-13T18:00:09.867Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-13T18:50:18.726Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:composer/zofe/rapyd-admin", "product": "rapyd-admin", "repo": "https://github.com/zofe/rapyd-admin", "vendor": "zofe", "versions": [{"lessThan": "9.20.0", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "9.20.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users."}], "id": "CVE-2026-110238", "lastModified": "2026-10-14T17:18:24.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-110238", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-14T16:27:34.431150Z", "version": "2.0.3"}}]}, "published": "2026-10-13T19:18:49.063", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/zofe/rapyd-admin"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php#L27-L81"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.php#L17-L20"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorization-bypass-via-usersmodaleditembed-component"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "9.20.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rapyd-admin", "source": "cna", "vendor": "zofe"}, "product": "rapyd-admin", "vendor": "zofe"}], "created": "2026-10-14T06:15:17.514426+00:00", "updated": "2026-10-17T06:00:04.213953+00:00", "vendors": ["zofe", "zofe$PRODUCT$rapyd-admin"]}