BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter

Advisories

BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter

Severity: medium
Date: 10/16/2026
Affecting: buildadmin <= 2.3.9
CVE: CVE-2026-111648
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@hieuPenguinnn/buildadmin-admininfo-edit-cross-admin-idor
https://github.com/build-admin/buildadmin/blob/468652294e6a6a794bf1113f0847b93337d69fb4/app/admin/controller/routine/AdminInfo.php#L36-L89
https://github.com/build-admin/buildadmin
Credit: hieuPenguinnn
Description: BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo