Skip to main content
VulnerabilityPublished 07/24/2026

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Affects poweradmin/poweradminSource GCVE Database

CVSS 3.1 base score
8.1High
Patch
Available – fixed in 3.9.11, 4.2.5, 4.3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for unusual DNS record changes. Avoid running multi-tenant Poweradmin instances without additional access control enforcement. The vendor advisory or project repository should be monitored for patches addressing this broken access control issue.

Affected software

ProductAffectedFixed in
Packagistpoweradmin/poweradminAffected
  • >=3.0.0 <3.9.11
Fixed in
  • 3.9.11
Packagistpoweradmin/poweradminAffected
  • >=4.0.0 <4.2.5
Fixed in
  • 4.2.5
Packagistpoweradmin/poweradminAffected
  • >=4.3.0 <4.3.4
Fixed in
  • 4.3.4

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Poweradmin versions 3.0.0 through before 3.9.11, 4.0.0 through before 4.2.5, and 4.3.0 through before 4.3.4 contain a broken access control vulnerability. Authenticated users who own at least one DNS zone can modify DNS records in zones they do not own due to improper validation of record ownership during record edits. This allows cross-tenant DNS record modification in multi-tenant environments. The vulnerability arises because the permission check validates the zone ID from the request but the update applies to a record ID from the request without verifying that the record belongs to the authorized zone. The delete operation correctly enforces ownership, indicating this is an oversight in the edit path. No known exploits in the wild have been reported.

Weaknesses

References