Rapyd Admin CVE-2026-109565

Requires that open/self-service user registration be enabled, allowing an anonymous attacker to choose their own display name; the attacker sets a name containing '<'/'>' and script markup. The payload only fires when a privileged user views a view that renders the name through the vulnerable x-rpd::select-list component - specifically the Logs → Activity Author filter, and the users and permissions forms. Limiting factors: exploitation depends on administrator user interaction (UI:P) to open the affected view, impact is confined to the admin's browser session rather than the server, and instances where registration is closed or names are otherwise sanitized are not exposed. Versions 9.20.0 and later escape the labels and reject names containing '<' or '>'.

This is a stored (persistent) XSS (CWE-79) in the zofe/rapyd-admin Laravel admin package, affecting 9.4.0 before 9.20.0. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.3) is internally consistent with the description: AV:N and PR:N reflect that any unauthenticated attacker can self-register, UI:P reflects that an administrator must passively view the Activity log Author filter for the payload to fire, and the impact is modeled on the subsequent system (SC:L/SI:L) - i.e. the admin's browser session - rather than the vulnerable component itself, with no direct VC/VI/VA. No EPSS score, KEV entry, or public exploit was provided in the input. Exploitation status is therefore 'no public exploit identified at time of analysis'; this is NOT confirmed active exploitation. Real-world risk is moderate-but-conditional rather than a drop-everything priority: the unauthenticated entry point is attractive, but exploitation is gated on open self-registration being enabled and on an administrator actually opening the affected filter/forms, and impact is limited to actions within the admin's authenticated session (which, given the companion account-takeover fixes in the same release, could be chained to meaningful damage). The product footprint is small (an open-source developer package), which tempers aggregate risk. Note the CWE/description say stored XSS while the base CVSS reports C:N/I:N on the vulnerable system - this is expected for XSS scored on the subsequent system and is not a contradiction.

An attacker visits the open registration page of a Rapyd Admin instance and signs up with a display name containing a JavaScript/HTML payload instead of a real name. The malicious name is stored and later rendered unescaped in the select-list option labels of the Activity log Author filter (and the users/permissions forms); when an administrator opens that view, the script executes in the admin's authenticated session. No public proof-of-concept was provided in the input, though the fixing commit (acd6ee8) clearly documents the vulnerable sink.