CVE-2026-109566

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-create...

CVE-2026-109567

Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin rol...

CVE-2026-109565

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

EUVD-2026-97890

Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin rol...

CVE-2026-109567 Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component

Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin rol...

CVE-2026-109567

The Rapyd Admin software (versions 9.0.0 through 9.20.0) is affected by an improper privilege management vulnerability within the UsersEdit Livewire component . This flaw allows users possessing the "edit users" permission—such as those with the shipped operator role—to assign themselves the admi...

EUVD-2026-97889

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-create...

CVE-2026-109566

Rapyd Admin versions 9.0.0 through 9.19.0 are vulnerable to a hard-coded credentials flaw. The AuthSeeder component seeds an admin@laravel account with the password admin during installation and silently re-creates it during every rpd:make run. This allows remote unauthenticated attackers to gain...

CVE-2026-109566 Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-create...

EUVD-2026-97888

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

CVE-2026-109565 Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

CVE-2026-109565

Rapyd Admin versions 9.4.0 through 9.19.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the unescaped rendering of self-registered display names within the Activity log Author filter . Unauthenticated attackers can register with a malicious HTML or JavaScr...