Poweradmin's record editing functionality suffers from an Insecure Direct Object Reference (IDOR) vulnerability caused by broken access control. When editing DNS records, the system checks user permissions against a zone ID submitted in the POST request but applies changes to a record ID also submitted in the request without verifying that the record belongs to the authorized zone. This flaw allows any authenticated user owning at least one zone to modify records in any other zone on the server, effectively enabling cross-tenant DNS record tampering. The vulnerability exists in multiple request paths for saving records and is due to the lack of tying the record ID to the zone ID during permission checks and updates. The delete path correctly enforces ownership by deriving the zone ID from the record ID server-side, demonstrating this is an implementation oversight rather than a design choice.

An attacker with an account owning at least one DNS zone can modify DNS records in zones they do not own. In multi-tenant Poweradmin deployments, this can lead to unauthorized DNS record changes across tenants, potentially enabling DNS hijacking or redirection attacks. The vulnerability does not allow unauthorized access to zones but bypasses record-level access control, resulting in high integrity and availability impact on DNS records. Confidentiality impact is not indicated. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for unusual DNS record changes. Avoid running multi-tenant Poweradmin instances without additional access control enforcement. The vendor advisory or project repository should be monitored for patches addressing this broken access control issue.