BuildAdmin versions up to 2.3.9 contain an insecure direct object reference that permits authenticated backend administrators with the routine/adminInfo/edit permission to edit other administrators’ profiles. The attacker can overwrite fields such as avatar, nickname, email, mobile, and motto, including a super administrator’s email and mobile information. This flaw allows covert manipulation of administrative account data, potentially leading to impersonation and unauthorized access to sensitive contact details, without granting additional code execution or system control.

The vulnerability affects the BuildAdmin platform supplied by the build-admin vendor. Any deployments of BuildAdmin through version 2.3.9 are impacted. No later versions are known to be affected according to the provided data.

The product carries a CVSS score of 5.1, indicating moderate severity. EPSS is not reported, suggesting there is no publicly known exploitation data at this time. The vulnerability is not listed in the CISA KEV catalog, reinforcing that it is not among the most actively exploited flaws. Exploitation requires a legitimate administrator account with the routine/adminInfo/edit permission, limiting the attack surface. Nevertheless, because the attacker can alter other administrators’ key identifying details, the risk to confidentiality and integrity of administrative profiles remains significant.