CVE-2026-111648
Received Received - Intake

Insecure Direct Object Reference in BuildAdmin Admin Profile Modification

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111648
EUVD
EUVD-2026-103070

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
build-admin buildadmin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

BuildAdmin through 2.3.9 has an insecure direct object reference vulnerability. Authenticated backend administrators can modify other administrators' profiles by changing the id parameter. Attackers with the routine/adminInfo/edit permission can overwrite fields like avatar, nickname, email, mobile, and motto, including a super administrator's email and mobile.

Impact Analysis

This vulnerability allows attackers to take over administrator accounts by changing critical details like email or mobile. Super administrators could lose control of their accounts, leading to unauthorized access and potential system compromise.

Mitigation Strategies

Update BuildAdmin to the latest version beyond 2.3.9 to address the insecure direct object reference vulnerability. Restrict the routine/adminInfo/edit permission to only necessary administrators and review all user profiles for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111648. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart