CVE-2026-109567 in Rapyd Admin
Summary
by MITRE • 10/13/2026
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Rapyd Admin versions prior to 9.20.0 represents a critical failure in server-side access control mechanisms within the UsersEdit Livewire component. This flaw is classified as an improper privilege management issue, specifically falling under CWE-269: Improper Privilege Management. The core technical defect lies in the application's inability to validate whether a user requesting role assignment has the legitimate authority to assign that specific role to themselves or others. In secure systems, even users with elevated permissions such as editing other accounts should be restricted from modifying their own privilege levels to prevent self-elevation attacks. However, this implementation fails to enforce tenant scoping and per-record authorization checks when processing requests related to user roles.
An attacker possessing a standard operational role, such as the shipped operator role, can exploit this weakness by manipulating HTTP requests sent to the UsersEdit endpoint. By submitting a payload that includes the admin role ID for their own account identifier, the application processes the request without verifying if the actor is authorized to grant administrative privileges. This bypasses the intended security boundaries because the framework does not distinguish between modifying another user's profile and self-modification in terms of privilege escalation checks. Consequently, the attacker successfully elevates their access level from a low-privileged operational role to an administrator account with full system control.
The operational impact of this vulnerability is severe, as it allows for complete compromise of the affected Rapyd Admin instance. Once an attacker achieves administrative privileges through self-elevation, they gain unrestricted access to all data and functionality within the tenant scope. This includes the ability to view sensitive customer information, modify transaction records, manage other user accounts, and potentially execute further attacks such as cross-site scripting or server-side request forgery if additional vectors exist. The bypass of per-record authorization means that security controls designed to limit actions based on specific resource ownership are rendered ineffective for this particular action path.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1078: Valid Accounts, specifically the sub-technique of privilege escalation or account manipulation. Attackers leverage valid credentials and existing permissions to move laterally within the system by gaining higher-level access. The exploitation does not require complex binary exploits or memory corruption; it relies purely on logical flaws in the application's business logic layer, making it easily exploitable with standard web tools like Burp Suite or simple curl commands.
Mitigation strategies must focus on enforcing strict server-side validation for all privilege-related operations. Developers should implement a deny-by-default approach where any attempt to change user roles is validated against an explicit allow list of authorized actors and actions. Specifically, the application logic must prevent users from modifying their own role assignments regardless of other permissions they hold. Additionally, implementing multi-factor authentication for administrative functions can provide a secondary layer of defense even if privilege escalation occurs. Upgrading to Rapyd Admin version 9.20.0 or later is essential as it addresses these logical flaws by correcting the authorization checks within the Livewire component. Regular security audits focusing on access control logic and automated testing using tools that simulate role-based attacks are recommended to detect similar vulnerabilities in other parts of the application.