CVE-2026-127092
Last modified
CVE-2026-127092 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover..
Description
BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-127092?
How severe is CVE-2026-127092?
How do I fix CVE-2026-127092?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-127085Ryot before 10.5.6 contains an authorization bypass vulnerab…4.3
- CVE-2026-127086Ryot before 10.5.6 contains an authorization bypass vulnerab…6.3
- CVE-2026-127087Ryot before 10.5.6 contains an authorization bypass vulnerab…3.1
- CVE-2026-1270882FAuth before 9.0.1 contains a weak password recovery vulner…8.1
- CVE-2026-127090Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x be…8.8
- CVE-2026-127091Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x be…6.8
- CVE-2026-127093Rustrak before 0.26.0 contains a server-side request forgery…5.5
- CVE-2026-127094Pagelayer 2.1.7 before 2.2.1 contains a missing authorizatio…7.6
- CVE-2026-127099A flaw was found in SSSD's conversion of X.509 certificate R…5.9
- CVE-2026-1271The ProfileGrid – User Profiles, Groups and Communities plug…5.3
- CVE-2026-12710A Missing Authorization vulnerability in the QueryEngineTask…9.3
- CVE-2026-127100A flaw was found in SSSD's PAM responder on builds with the …5.5
Are you affected by CVE-2026-127092?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST