Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.1, published 24 July 2026.

Which products and versions are affected?

Poweradmin >= 3.0.0, = 4.0.0, = 4.3.0, < 4.3.4.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run Poweradmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Poweradmin IDOR in DNS record editing

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run Poweradmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 8.1 · Published 2026-07-24

Poweradmin, a web-based management tool for PowerDNS, contains a security flaw that allows any user with permission to manage at least one DNS zone to modify records in any other zone on the system. In environments where multiple customers or departments share the same server, an attacker could redirect web traffic, disable services, or take over domains they do not own. This bypasses intended access controls and can lead to a complete compromise of DNS integrity for all users on the platform.

Technologies: Poweradmin. Vendors: Poweradmin.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.1, published 24 July 2026.
Which products and versions are affected?: Poweradmin >= 3.0.0, < 3.9.11; >= 4.0.0, < 4.2.5; >= 4.3.0, < 4.3.4.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run Poweradmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) exists in the record editing component of Poweradmin. The `RecordManager::editRecord()` function validates user ownership against a provided zone ID (`zid`) but performs the database update using a separate record ID (`rid`) without verifying that the record actually belongs to the validated zone. An authenticated attacker can provide a `zid` they own to pass the permission check while supplying a `rid` belonging to a victim's zone to overwrite its content. This affects both single-record and multi-record save paths in `EditRecordController` and `EditController`. The vulnerability allows for unauthorized modification of record names, types, content, and status (enabled/disabled) across the entire installation.

Affected products

Poweradmin Poweradmin >= 3.0.0, < 3.9.11; >= 4.0.0, < 4.2.5; >= 4.3.0, < 4.3.4

Timeline

2026-07-23: advisory: Initial GitHub Advisory publication
2026-07-24: disclosed: Full disclosure of vulnerability details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.