CVE-2026-109567: Improper Privilege Management in zofe rapyd-admin

Rapyd Admin versions >=9.0.0 and <9.20.0 contain an improper privilege management vulnerability in the UsersEdit Livewire component. Users who have the 'edit users' permission can exploit this flaw by submitting the admin role ID for their own account, effectively elevating their privileges to admin. This bypasses tenant scoping and per-record authorization mechanisms, allowing attackers with roles such as the default operator role to impersonate administrators and gain unauthorized access.

Successful exploitation allows privilege escalation from roles with limited permissions (e.g., operator) to full administrative privileges. This bypasses tenant scoping and per-record authorization, enabling attackers to impersonate administrators and potentially perform any administrative actions within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the 'edit users' permission to trusted administrators only and monitor for unauthorized role changes. Avoid granting the 'edit users' permission to roles that should not have privilege escalation capabilities.