CVE-2026-110238

Summary

A vulnerability in Rapyd Admin allows authenticated users with default customer roles to bypass authorization and modify or delete any user account, potentially enabling attackers to reset admin passwords, promote themselves to owner, or delete users.

Exploitability

The exploit is straightforward requiring only authentication as a company member with the default customer role, and predictable sequential user IDs to dispatch editUser or deleteUser commands.

Blast radius

The impact could be significant as attackers can gain full administrative control by resetting owner or super admin passwords and deleting key users, affecting the entire application's integrity and access control.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 9.20.0 or later to address the authorization bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.