BuildAdmin CVE-2026-111648

Requires a valid, authenticated BuildAdmin backend administrator account that also holds the specific routine/adminInfo/edit permission; the attacker then manipulates the id parameter of the admin-profile edit endpoint to reference another administrator's account. Limiting factors: no anonymous or unauthenticated path exists (PR:H), so the attacker must already possess privileged credentials with that permission granted - making this primarily an insider or post-compromise privilege-abuse scenario rather than remote mass exploitation; no user interaction is needed (UI:N). Impact is bounded to overwriting profile fields (avatar, nickname, email, mobile, motto), with the practical escalation risk being takeover of a super administrator via the altered email/mobile.

This is a genuine but low-to-moderate priority issue, not a high-urgency flaw. The CVSS 4.0 base score is 5.1 (Medium), and the vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N) tells the real story: exploitation requires an already-authenticated backend administrator who additionally holds the routine/adminInfo/edit permission (PR:H), and the only impact is a limited integrity hit (VI:L) with no confidentiality or availability loss. No EPSS score was provided in the input, and there is no CISA KEV listing, so exploitation status is 'no public exploit identified at time of analysis' - though a detailed technical writeup (hackmd) and the vulnerable source code are publicly referenced, lowering the bar to reproduce it. There is no SSVC decision data in the input. The signals are internally consistent (high-privilege authorization/IDOR flaw with limited blast radius); the main caveat is that the most damaging described effect - overwriting a super administrator's email and mobile - could enable a follow-on account-takeover via password-reset flows, which the base VI:L arguably understates. Overall: a real broken-access-control defect worth patching, but dependent on an insider or an already-compromised privileged account rather than widespread remote exploitation.

A low-trust backend administrator who has been granted the routine/adminInfo/edit permission changes the id parameter in the admin-profile edit request to the super administrator's account ID and overwrites that account's email and mobile fields. By pointing the super admin's email to an attacker-controlled address, the attacker can then abuse a password-reset flow to hijack the highest-privileged account. A public technical writeup describes the flaw, but no weaponized exploit tool was identified in the provided data.