---
id: "CVE-2026-127092"
page: "https://infrastack.ai/live/CVE-2026-127092"
kind: "vulnerability"
aliases: ["CVE-2026-127092"]
title: "BuildAdmin: unauthenticated header injection stores script that steals admin tokens"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "BuildAdmin", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["buildadmin", "other", "php", "self-hosted"]
not_affected_if: ["version-outside-range"]
published_at: "2026-11-13T10:18:05+00:00"
first_seen_at: "2026-11-13T10:47:30+00:00"
updated_at: "2026-11-13T10:55:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127092", "first_seen_at": "2026-11-13T10:47:30+00:00"}]
exploit_sources: []
---

# BuildAdmin: unauthenticated header injection stores script that steals admin tokens

Link for people: https://infrastack.ai/live/CVE-2026-127092 (this .md is for agents)

BuildAdmin 1.0.1 through 2.3.9 stores javascript: URLs sent in the X-Rewrite-URL header into its admin operation log without authentication. When an administrator clicks the log entry's open button, the script runs in the admin backend and reads the adminInfo token from localStorage, which allows account takeover.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BuildAdmin affected range not listed fixed no fixed version listed

## How to check

- Check the installed BuildAdmin version against the affected range `1.0.1` through `2.3.9`.
- Review the admin operation log for entries containing `javascript:` URLs.

## Timeline

- 2026-11-13T10:47:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127092

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/buildadmin-1.0.1-through-2.3.9-stored-xss-via-x-rewrite-url-in-admin-log

## From the sources

BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_