Rapyd Admin EUVD-2026-99022

Requires an authenticated account holding the default 'customer' role (which carries 'edit own users') on Rapyd Admin 9.0.0 through 9.19.x; per the vendor changelog self-registration is open, so any attacker can obtain this role. Exploitation then needs only that the UsersModalEditEmbed Livewire component be reachable and that target user IDs be guessed - IDs are sequential and predictable, so no additional information is required. Limiting factors: the attacker must be a logged-in member (not fully unauthenticated), and instances upgraded to 9.20.0 (or 9.19.0, where the fix landed) are not exploitable because id resolution is now bound to the caller's authority; no other non-default configuration is needed.

This is a genuine high-priority issue despite a non-critical numeric score. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7) shows network-reachable, low-complexity exploitation requiring only low privileges (PR:L) and no user interaction, with high confidentiality/integrity/availability impact on the vulnerable system. The PR:L is the single factor keeping this below critical, but the vendor's own changelog states registration is open and the default 'customer' role (which every registered member holds) is sufficient - so the authentication barrier is effectively trivial to satisfy. The flaw is a classic IDOR (CWE-639): sequential, predictable user IDs taken from the browser with only a permission check, making exploitation deterministic and highly automatable. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no confirmed active exploitation; however, the absence of these signals does not lower the intrinsic risk given how simple and reliable the attack is. Note the input Tags label this 'Authentication Bypass' while the description and CWE-639 make clear it is an authorization (access control) bypass by an already-authenticated user - these are distinct, and the tag is imprecise.

An attacker registers an ordinary account (default customer role) on a Rapyd Admin 9.x instance, then uses the UsersModalEditEmbed Livewire component to dispatch editUser against a guessed low, sequential user id belonging to the company owner or super admin, resetting that account's password or promoting their own account to owner. No public exploit code was identified in the provided data, but the attack requires only knowledge of the Livewire action names and predictable IDs. Given AV:N/AC:L/PR:L, it is remotely and reliably reproducible by any authenticated member.