---
id: CVE-2026-111648
title: BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter
summary: >-
  BuildAdmin through 2.3.9 contains an insecure direct object reference
  vulnerability that allows authenticated backend administrators to modify other
  administrators' profiles via the id parameter. Attackers holding the
  routine/adminInfo/e…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: build-admin
product: buildadmin
affected:
  - buildadmin <= 2.3.9
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:39:16.585Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111648'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/buildadmin-admininfo-edit-cross-admin-idor
  - url: >-
      https://github.com/build-admin/buildadmin/blob/468652294e6a6a794bf1113f0847b93337d69fb4/app/admin/controller/routine/AdminInfo.php#L36-L89
  - url: 'https://github.com/build-admin/buildadmin'
  - url: >-
      https://www.vulncheck.com/advisories/buildadmin-through-2.3.9-idor-via-routine-admininfo-edit-id-parameter
    label: >-
      VulnCheck Advisory: BuildAdmin through 2.3.9 IDOR via
      routine/adminInfo/edit id Parameter
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.678Z'
---

## Overview

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.

## Affected

- `buildadmin <= 2.3.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.