Rapyd Admin EUVD-2026-99023

Exploitation requires (1) a valid authenticated account with low privileges sufficient to invoke the Livewire client API and set the bound model property of an x-rpd::rich-text component, and (2) a subsequent action by a victim administrator who opens the affected record's form, at which point the stored payload executes. It is limited to Rapyd Admin versions before the fixed release (CVE cites <9.20.0; vendor CHANGELOG cites 9.19.0) and to forms that use the x-rpd::rich-text component rendering values as raw HTML. The need for prior authentication plus administrator interaction substantially limits realistic exploitation compared to an unauthenticated remote flaw.

This is a low-priority, low-real-risk issue despite being a code-execution-style flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P) scores only 2.1 because exploitation requires an authenticated account (PR:L) and passive victim interaction (UI:P) - an administrator must open the affected record's form - and the direct impact on the vulnerable system is nil (VC:N/VI:N/VA:N), with only low subsequent-system confidentiality/integrity impact (SC:L/SI:L) reflecting script execution in the admin's browser session. There is no KEV listing, no EPSS score was provided, and no public exploit was identified, so exploitation status is 'no public exploit identified at time of analysis'. The source-code evidence strongly corroborates the vulnerability mechanism: the x-rpd::rich-text component echoed browser-written values raw via Blade's {!! !!} and the fix routes them through rapyd_clean_html() (HTMLPurifier). One data note: the vendor CHANGELOG labels the security release as 9.19.0 (dated 2026-09-28) while the CVE and release tag reference 9.20.0 as the fixed version - verify the exact patched build with the vendor. Overall this is a genuine stored XSS but a realistic second-order, authenticated, interaction-dependent threat rather than an urgent widespread one.

An attacker with a low-privileged authenticated account uses the Livewire client API to set the bound model property of an x-rpd::rich-text field to a malicious payload, which is stored unsanitized. When an administrator later opens that record's form, the injected JavaScript executes in the admin's authenticated session, enabling session/account actions in the admin context. No public exploit code was identified, though a VulnCheck advisory documents the flaw.