CVE-2026-109565

6.1Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.1Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can hijack admin sessions or execute arbitrary JavaScript in an administrator's browser. The attacker needs public registration enabled, then an administrator must view the Activity log Author filter.

Root cause

The select-list component renders self-registered user display names without HTML escaping inside the Activity log Author filter.

Affected systems

Rapyd Admin 9.4.0 through 9.19.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade to Rapyd Admin 9.20.0 or later. If patching immediately is not possible, disable public user self-registration.

shell

$ composer update zofe/rapyd-admin

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109565