# CVE-2026-110238: Rapyd Admin authorization bypass in UsersModalEditEmbed

Source: https://junglewise.ai/threats/cve-2026-110238-rapyd-admin-from-9-0-0-before-9-20-0-contains-an-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110238 · Severity: high · CVSS 8.8 · Published 2026-10-13

Rapyd Admin is an open-source admin panel for Laravel applications. An authentication bypass vulnerability allows users with a default customer role to modify or delete arbitrary user accounts, including administrators. Attackers can reset passwords, promote themselves to owner, or delete other users by exploiting predictable user IDs.

Technologies: [Zofe Rapyd Admin](https://junglewise.ai/threats/technologies/rapyd-admin). Vendors: [Zofe](https://junglewise.ai/threats/vendors/zofe).

## Quick answers

**Is CVE-2026-110238 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110238 being exploited in the wild.

**How severe is CVE-2026-110238?** High severity, with a CVSS score of 8.8, published 13 October 2026.

**Which products and versions are affected?** Zofe Rapyd Admin 9.0.0 before 9.20.0.

**Is there a fix for CVE-2026-110238?** Yes: fixed in 9.20.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110238 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110238?** Check whether you run Zofe Rapyd Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.20.0

## Technical details

The UsersModalEditEmbed Livewire component in Rapyd Admin 9.0.0 through 9.19.0 performs insufficient authorization checks on the editUser and deleteUser event handlers. Although a booted() method calls authorize('admin|edit users|edit own users'), authenticated users with the default customer role can dispatch these events directly with arbitrary user IDs, bypassing role-based access controls. The vulnerability is rooted in insecure direct object references combined with weak permission validation in Livewire's event dispatch mechanism.

## Affected products

- zofe Rapyd Admin 9.0.0 before 9.20.0

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/zofe/rapyd-admin](https://github.com/zofe/rapyd-admin)
- [https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php](https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php)

## Related threats

- [Rapyd Admin stored cross-site scripting in rich-text component](https://junglewise.ai/threats/cve-2026-110239-rapyd-admin-before-9-20-0-contains-a-stored-cross-site-scripting)
- [Rapyd Admin hard-coded credentials in AuthSeeder](https://junglewise.ai/threats/cve-2026-109566-rapyd-admin-from-9-0-0-before-9-20-0-contains-a-hard-coded)
- [Rapyd Admin stored cross-site scripting in display names](https://junglewise.ai/threats/cve-2026-109565-rapyd-admin-from-9-4-0-before-9-20-0-contains-a-stored-cross)