CVE-2026-111648 — BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter
BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via…
Published: 2026-10-16 · CVSS: 5.1 · CVSS 4.0
BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7