CVE Intelligence

Zofe Rapyd-admin vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Zofe Rapyd-admin: 5 record(s), with affected versions and fixes.

CVE-2026-110239 Medium · 4.4 CWE-79 Oct 13, 2026
Rapyd Admin before 9.20.0 Stored XSS via rich-text Component
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
CVE-2026-110238 High · 8.8 CWE-639 Oct 13, 2026
Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
CVE-2026-109567 High · 7.2 CWE-269 Oct 12, 2026
Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
CVE-2026-109566 Critical · 9.8 CWE-798 Oct 12, 2026
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
CVE-2026-109565 Medium · 6.1 CWE-79 Oct 12, 2026
Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.