CVE-2026-111648 build-admin CVE debrief

Who should care

BuildAdmin administrators and security teams should assess exposure and prioritize verification for instances with multiple administrators. They should review and restrict routine/adminInfo/edit permission assignments, monitor for suspicious administrator profile modifications, and verify the integrity of administrator profiles and accounts.

Why it matters

CVE-2026-111648 is a medium-severity IDOR vulnerability in BuildAdmin through 2.3.9 that allows authenticated administrators to modify other administrators' profiles. Defenders should assess exposure, restrict permission assignments, and monitor for suspicious activity.

• Authenticated administrators can modify other administrators' profiles, including super administrators' email and mobile fields.
• The vulnerability requires the routine/adminInfo/edit permission, which may be held by multiple administrators.
• Verification of administrator access controls and monitoring for suspicious profile modifications are necessary.

Technical summary

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter in the routine/adminInfo/edit endpoint. This vulnerability requires the routine/adminInfo/edit permission, which may be held by multiple administrators. The vulnerability can lead to unauthorized modifications of sensitive fields, including email and mobile, of other administrators, including super administrators. Defenders should assess exposure, restrict permission assignments, and monitor for suspicious activity.

Defensive priority

Assess exposure and prioritize verification for BuildAdmin instances, especially those with multiple administrators.

Recommended defensive actions

• Assess BuildAdmin instance exposure and verify administrator access controls
• Review and restrict routine/adminInfo/edit permission assignments
• Monitor for suspicious administrator profile modifications
• Verify the integrity of administrator profiles and accounts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the IDOR vulnerability in BuildAdmin through 2.3.9. The vulnerability is confirmed to exist in versions up to 2.3.9 and allows authenticated administrators to modify other administrators' profiles. Evidence is based on the official CVE Program record and a source item describing the vulnerability. Defenders should verify the vulnerability's existence, assess exposure, and monitor for suspicious profile modifications.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.