Low severity · published Oct 16, 2026
CVE-2026-111648
BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter
2.7
CVSS
0.4%
EPSS
No
On KEV
Description
BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
buildadmin · build-admin
through 2.3.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111648
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111648
github.com
https://github.com/build-admin/buildadmin
github.com
https://github.com/build-admin/buildadmin/blob/468652294e6a6a794bf1113f0847b93337d69fb4/app/admin/controller/routine/AdminInfo.php#L36-L89
hackmd.io
https://hackmd.io/@hieuPenguinnn/buildadmin-admininfo-edit-cross-admin-idor
www.vulncheck.com
https://www.vulncheck.com/advisories/buildadmin-through-2.3.9-idor-via-routine-admininfo-edit-id-parameter