Low severity2.7NVD Advisory· Published Oct 16, 2026· Updated Oct 16, 2026

CVE-2026-111648

Description

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.

Affected products

Build Admin/buildadminllm-fuzzy
Range: <=2.3.9

Patches

Vulnerability mechanics

References

github.com/build-admin/buildadmin/blob/468652294e6a6a794bf1113f0847b93337d69fb4/app/admin/controller/routine/AdminInfo.phpnvd
hackmd.io/@hieuPenguinnn/buildadmin-admininfo-edit-cross-admin-idornvd
www.vulncheck.com/advisories/buildadmin-through-2.3.9-idor-via-routine-admininfo-edit-id-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.176
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000