Buildadmin
Monthly
BuildAdmin through 2.3.9 contains an insecure direct object reference in the backend admin-profile edit endpoint (routine/AdminInfo/edit), allowing an authenticated administrator who holds that permission to overwrite another administrator's profile by manipulating the id parameter. The writable fields are avatar, nickname, email, mobile and motto; because altered email and mobile values commonly drive administrative account recovery and notification flows, the meaningful escalation path is takeover of a super administrator account rather than mass compromise. No public exploit code and no CISA KEV listing were identified at time of analysis, so this is a low-to-moderate priority issue whose exploitation requires an already-privileged backend session with the specific permission granted.
BuildAdmin through 2.3.9 contains an insecure direct object reference in the backend admin-profile edit endpoint (routine/AdminInfo/edit), allowing an authenticated administrator who holds that permission to overwrite another administrator's profile by manipulating the id parameter. The writable fields are avatar, nickname, email, mobile and motto; because altered email and mobile values commonly drive administrative account recovery and notification flows, the meaningful escalation path is takeover of a super administrator account rather than mass compromise. No public exploit code and no CISA KEV listing were identified at time of analysis, so this is a low-to-moderate priority issue whose exploitation requires an already-privileged backend session with the specific permission granted.