CVE-2026-127092: BuildAdmin 1.0.1 through 2.3.9 Stored XSS via X-Rewrite-URL in Admin Log
BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
BuildAdmin versions 1.0.1 through 2.3.9 are affected. The vulnerable behavior is in the admin operation log handling of the X-Rewrite-URL header.
What must an attacker do to exploit this issue?
An unauthenticated attacker must submit a request with a javascript: URL in the X-Rewrite-URL header so that it is stored in the admin operation log. An administrator must then click the affected log entry's URL-open button.
What is the practical impact if exploitation succeeds?
The script executes under the backend origin and can steal the adminInfo token from localStorage. The stolen token can enable takeover of the administrator account.
How can an administrator determine whether they may already be affected?
Review admin operation log entries for attacker-controlled or suspicious URLs, particularly values using the javascript: scheme. Entries created through requests carrying X-Rewrite-URL are relevant to this issue.