Insecure direct object reference in BuildAdmin admin profile editing
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
BuildAdmin through 2.3.9 contains an insecure direct object reference that lets authenticated backend administrators modify other administrators' profiles through the id parameter of routine/adminInfo/edit. An attacker with the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile. The CVSS 4.0 vector requires high privileges and network access, and the weakness is classified as CWE-639.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| build-admin | buildadmin | up to 2.3.9 | — | No fix listed | CNA |
- buildadmin Vendorbuild-admin Affected up to 2.3.9 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for BuildAdmin.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Vendor assessments
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111648
- 2026-10-16 Alias added: GHSA-mrm7-fvcm-h52j
- 2026-10-23 CISA SSVC decision points changed
- 2026-10-23 Priority changed: LOW → MEDIUM
- 2026-11-07 Affected versions changed · Red Hat
- 2026-11-07 CVSS score added · Red Hat
References
Sources
- CVE-2026-111648 · CVE Program
- CVE-2026-111648 · NVD
- FIRST EPSS
- GHSA-mrm7-fvcm-h52j · GitHub Advisory Database · CC BY 4.0
- CVE-2026-111648 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences