{"id":"CVE-2026-127092","kind":"vulnerability","aliases":["CVE-2026-127092"],"related":[],"title":"BuildAdmin: unauthenticated header injection stores script that steals admin tokens","description":"BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover.","summary":"BuildAdmin 1.0.1 through 2.3.9 stores javascript: URLs sent in the X-Rewrite-URL header into its admin operation log without authentication. When an administrator clicks the log entry's open button, the script runs in the admin backend and reads the adminInfo token from localStorage, which allows account takeover.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BuildAdmin","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["buildadmin","other","php","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed BuildAdmin version against the affected range `1.0.1` through `2.3.9`.\n- Review the admin operation log for entries containing `javascript:` URLs.","fix":null,"status":"open","published_at":"2026-11-13T10:18:05+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","triaged_at":"2026-11-13T10:55:27+00:00","updated_at":"2026-11-13T10:55:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T10:55:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BuildAdmin: unauthenticated header injection stores script that steals admin tokens","impact":"high","summary":"BuildAdmin 1.0.1 through 2.3.9 stores javascript: URLs sent in the X-Rewrite-URL header into its admin operation log without authentication. When an administrator clicks the log entry's open button, the script runs in the admin backend and reads the adminInfo token from localStorage, which allows account takeover.","audience":"businesses","category":"other","nicknames":[],"who_cares":["buildadmin","self-hosted","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"admin account takeover through stolen session token in browser storage","analyst_note":"Confirm the fixed version and any vendor patch from the vulncheck advisory or the BuildAdmin repository; the sources give no fix.","how_to_check":"- Check the installed BuildAdmin version against the affected range `1.0.1` through `2.3.9`.\n- Review the admin operation log for entries containing `javascript:` URLs.","plain_action":"","product_name":"BuildAdmin","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Any site running BuildAdmin in the affected version range whose admin operation log is viewed in a browser by an administrator. The request that plants the payload needs no login, so any internet-reachable admin panel is in scope. Installations on versions outside the range can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00075,"input_tokens":4618,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127092':13A,16A '-2026':12A,15A '1.0.1':25B,75C '2.3.9':27B,77C 'account':72B,132C 'admin':9A,41B,61B,96C 'admininfo':66B,127C 'administr':48B,108C 'allow':71B,87C 'attack':89C 'authent':45B 'backend':62B,122C 'buildadmin':1A,17A,18B,24B,74C 'button':55B,116C 'click':49B,109C 'contain':78C 'cross':82C 'cross-sit':81C 'cve':11A,14A 'enabl':131C 'entri':52B,112C 'header':3A,38B,105C 'host':23B 'inject':4A 'javascript':29B,92C 'localstorag':69B,130C 'log':43B,51B,98C,111C 'open':54B,115C 'oper':42B,97C 'origin':123C 'php':20B 'read':64B 'rewrit':36B,103C 'run':58B,119C 'script':6A,57B,84C,118C 'self':22B 'self-host':21B 'sent':31B 'site':83C 'steal':8A,125C 'store':5A,28B,80C,91C 'takeov':73B,133C 'token':10A,67B,128C 'unauthent':2A,88C 'url':30B,37B,93C,104C,114C 'via':99C 'vulner':85C 'without':44B 'x':35B,102C 'x-rewrite-url':34B,101C","nicknames":[],"mitigations":[],"who_affected":"Any site running BuildAdmin in the affected version range whose admin operation log is viewed in a browser by an administrator. The request that plants the payload needs no login, so any internet-reachable admin panel is in scope. Installations on versions outside the range can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["buildadmin"],"ptokens":["buildadmin"],"labels":["buildadmin","medium","other","php","selfhosted","vendor"],"campaign_type":null,"search_a":"'-127092':13A,16A '-2026':12A,15A 'admin':9A 'buildadmin':1A,17A 'cve':11A,14A 'header':3A 'inject':4A 'script':6A 'steal':8A 'store':5A 'token':10A 'unauthent':2A","search_b":"'1.0.1':25B '2.3.9':27B 'account':72B 'admin':41B,61B 'admininfo':66B 'administr':48B 'allow':71B 'authent':45B 'backend':62B 'buildadmin':18B,24B 'button':55B 'click':49B 'entri':52B 'header':38B 'host':23B 'javascript':29B 'localstorag':69B 'log':43B,51B 'open':54B 'oper':42B 'php':20B 'read':64B 'rewrit':36B 'run':58B 'script':57B 'self':22B 'self-host':21B 'sent':31B 'store':28B 'takeov':73B 'token':67B 'url':30B,37B 'without':44B 'x':35B 'x-rewrite-url':34B","search_c":"'1.0.1':75C '2.3.9':77C 'account':132C 'admin':96C 'admininfo':127C 'administr':108C 'allow':87C 'attack':89C 'backend':122C 'buildadmin':74C 'button':116C 'click':109C 'contain':78C 'cross':82C 'cross-sit':81C 'enabl':131C 'entri':112C 'header':105C 'javascript':92C 'localstorag':130C 'log':98C,111C 'open':115C 'oper':97C 'origin':123C 'rewrit':103C 'run':119C 'script':84C,118C 'site':83C 'steal':125C 'store':80C,91C 'takeov':133C 'token':128C 'unauthent':88C 'url':93C,104C,114C 'via':99C 'vulner':85C 'x':102C 'x-rewrite-url':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127092","severity":null,"published_at":"2026-11-13T10:18:05+00:00","modified_at":"2026-11-13T10:18:06+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","fetched_at":"2026-11-13T10:47:30+00:00","note":null}],"documents":[{"id":145318,"url":"https://www.vulncheck.com/advisories/buildadmin-1.0.1-through-2.3.9-stored-xss-via-x-rewrite-url-in-admin-log","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}