The defect is a missing authorization check in PowerDNS‑Admin’s apply_records endpoint (/admin/template/<template>/apply). An authenticated user with the User role can invoke this handler to overwrite the record set of a shared zone template. By supplying attacker‑chosen NS, MX, A or CNAME records, the user can inject these records into every zone that subsequently uses the template, effectively allowing domain splicing or traffic hijacking.

Affected product is PowerDNS‑Admin before the 2026.11.0 release, including all prior versions such as 2026.08.1. The vulnerability applies to installations that expose the /admin/template/<template>/apply route to authenticated users with the User role.

The CVSS score is 5.3, placing the vulnerability in the moderate severity range. EPSS data is not available, and it is not listed in the CISA KEV catalog, suggesting no confirmed exploitation as of now. The only prerequisite is an authenticated User‑role session, which many users may have. Attackers can achieve unauthorized modification of DNS templates, potentially redirecting or exfiltrating traffic, but the impact is limited to zones that use the compromised template.