Live › vulnerability › CVE-2026-111648
Go to dashboardBuildAdmin through 2.3.9 fails to check ownership of the id parameter on the admin profile edit endpoint. An authenticated backend administrator with the routine/adminInfo/edit permission can change other administrators' avatar, nickname, email, mobile and motto, including a super administrator's email and mobile.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running BuildAdmin 2.3.9 or earlier with a backend admin role that holds the routine/adminInfo/edit permission are exposed. Sites that do not use BuildAdmin, or that restrict that permission to super administrators only, have less exposure. The sources do not name a patched version.
No product ranges from the sources yet.
2.3.9 are affected.routine/adminInfo/edit permission.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.
This page as .md · .json · in your agent: get_signal("CVE-2026-111648")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.