CVE-2026-111648 Details

A cross-administrator insecure direct object reference vulnerability has been identified in BuildAdmin versions through 2.3.9. This vulnerability allows authenticated backend administrators to modify the profiles of other administrators by manipulating the 'id' parameter. Specifically, administrators with the 'routine/adminInfo/edit' permission can overwrite fields such as avatar, nickname, email, mobile, and motto. Notably, this includes the ability to change the email and mobile number of super administrators.

The vulnerability can be addressed by modifying the 'edit' method in the 'AdminInfo' controller to ensure that profile edits are restricted to the authenticated administrator's own record. This can be achieved by removing the reliance on the 'id' parameter and instead using the session's administrator ID to select the record for editing.