CVE-2026-109567 zofe CVE debrief

Who should care

Rapyd Admin users with edit users permission, security teams responsible for role-based access control, and operators managing user roles should be aware of this vulnerability. They should verify and restrict role assignments, review compensating controls, and monitor for suspicious activity to prevent exploitation. This vulnerability could lead to unauthorized access and control, bypassing per-record authorization and tenant scoping, and enabling imperson

Why it matters

CVE-2026-109567 allows users with edit users permission to escalate privileges to admin, potentially leading to unauthorized access and control.

• Potential elevation of privileges for users with edit users permission
• Bypassing of per-record authorization and tenant scoping
• Impersonation of other users or admin roles

Technical summary

The vulnerability is in the UsersEdit Livewire component of Rapyd Admin versions 9.0.0 to 9.19.0, allowing users with edit users permission to assign themselves the admin role. This could lead to unauthorized access and control, bypassing per-record authorization and tenant scoping, and enabling impersonation. The issue has been patched in version 9.20.0. Users should review and restrict role assignments to prevent exploitation. Limited technical details are available, and defenders should review official advisories and CVE records for further information.

Defensive priority

Rapyd Admin users with edit users permission should verify and restrict role assignments.

Recommended defensive actions

• Verify and restrict role assignments for users with edit users permission
• Update to version 9.20.0 or later
• Monitor for suspicious activity in the UsersEdit component
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows users with edit users permission to assign themselves the admin role via the UsersEdit Livewire component. This issue was identified in Rapyd Admin versions 9.0.0 to 9.19.0. The vulnerability has been patched in version 9.20.0. Users should verify and restrict role assignments to prevent exploitation. Limited evidence is available, and defenders should verify affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.