---
id: "CVE-2026-111648"
kind: "vulnerability"
aliases: ["CVE-2026-111648"]
title: "BuildAdmin: admin profile edit lets lower admins overwrite other admins"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["buildadmin", "package", "php", "self-hosted"]
not_affected_if: ["no-backend-admin-roles-with-edit-permission"]
published_at: "2026-10-16T18:17:45+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:29:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111648", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# BuildAdmin: admin profile edit lets lower admins overwrite other admins

BuildAdmin through 2.3.9 fails to check ownership of the id parameter on the admin profile edit endpoint. An authenticated backend administrator with the routine/adminInfo/edit permission can change other administrators' avatar, nickname, email, mobile and motto, including a super administrator's email and mobile.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the BuildAdmin version in the project's composer or package files; versions through `2.3.9` are affected.
- Review which roles hold the `routine/adminInfo/edit` permission.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111648

## From the sources

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_