CVE-2026-110238: rapyd-admin 9.0.0 to before 9.20.0

Affected technology

rapyd-admin · 9.0.0 to before 9.20.0
zofe

Description’s affected range: before 9.20.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.