BUILDADMIN · CVE-2026-127092 · Other
NO FIX YET
BuildAdmin 1.0.1 through 2.3.9 stores javascript: URLs sent in the X-Rewrite-URL header into its admin operation log without authentication. When an administrator clicks the log entry's open button, the script runs in the admin backend and reads the adminInfo token from localStorage, which allows account takeover.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any site running BuildAdmin in the affected version range whose admin operation log is viewed in a browser by an administrator. The request that plants the payload needs no login, so any internet-reachable admin panel is in scope. Installations on versions outside the range can skip it.
Not affected if version-outside-range
Who cares buildadmin, php, self-hosted
1.0.1 through 2.3.9.javascript: URLs.No fix yet, per the sources.
BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.