CVE-2026-111648

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile...

CVE-2026-111648

The software BuildAdmin (versions through 2.3.9 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw within the routine/adminInfo/edit functionality. Authenticated backend administrators possessing the routine/adminInfo/edit permission can exploit the id parameter to modify the prof...

EUVD-2026-103070

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile...

PT-2026-116047

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile...