CVE-2026-111648: BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter
BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated as a backend administrator and hold the routine/adminInfo/edit permission. The issue does not describe unauthenticated exploitation or exploitation by users without that permission.
What can an attacker change, and what is the likely impact?
The attacker can alter another administrator's avatar, nickname, email, mobile number, and motto by manipulating the id parameter. This includes the ability to replace a super administrator's email address and mobile number, creating an integrity risk for administrator profile and contact details.
Which deployments are known to be affected?
BuildAdmin versions through 2.3.9 are identified as affected. The provided information does not state whether any particular default role assignment grants the required permission.