CVE-2026-111648: BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter

Q: Who can exploit this issue?

An attacker must already be authenticated as a backend administrator and hold the routine/adminInfo/edit permission. The issue does not describe unauthenticated exploitation or exploitation by users without that permission.

Q: What can an attacker change, and what is the likely impact?

The attacker can alter another administrator's avatar, nickname, email, mobile number, and motto by manipulating the id parameter. This includes the ability to replace a super administrator's email address and mobile number, creating an integrity risk for administrator profile and contact details.

Q: Which deployments are known to be affected?

BuildAdmin versions through 2.3.9 are identified as affected. The provided information does not state whether any particular default role assignment grants the required permission.

Published Oct 16, 2026

Updated

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.

Affected Software

1 affected component

BuildAdmin BuildAdmin<=2.3.9

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must already be authenticated as a backend administrator and hold the routine/adminInfo/edit permission. The issue does not describe unauthenticated exploitation or exploitation by users without that permission.

What can an attacker change, and what is the likely impact?

The attacker can alter another administrator's avatar, nickname, email, mobile number, and motto by manipulating the id parameter. This includes the ability to replace a super administrator's email address and mobile number, creating an integrity risk for administrator profile and contact details.

Which deployments are known to be affected?

BuildAdmin versions through 2.3.9 are identified as affected. The provided information does not state whether any particular default role assignment grants the required permission.

CVE-2026-111648: BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change, and what is the likely impact?

Which deployments are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change, and what is the likely impact?

Which deployments are known to be affected?