CVE-2026-73317 in XenForo
Summary
by MITRE • 09/08/2026
XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body. Attackers can invoke the approval queue job under any user identity to approve queued user registrations without holding the required approval-queue or moderator permissions, causing the moderation log to attribute actions to an impersonated account.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in XenForo versions prior to 2.3.13 represents a critical failure in server-side access control mechanisms within the Admin Control Panel (ACP) infrastructure. Specifically, the flaw resides in the cache-rebuild dispatcher, which serves as an entry point for executing background jobs and administrative tasks. While this component is designed to handle system maintenance operations such as rebuilding caches, it inadvertently exposes functionality related to user registration approval queues due to insufficient validation of authorization scopes. This architectural oversight allows individuals with relatively low-privilege accounts to escalate their capabilities significantly by exploiting the loose coupling between permission checks and job execution parameters.
The technical root cause is a missing authorization check that fails to verify whether the authenticated user possesses specific moderator or administrative privileges required for approval queue operations. The vulnerability manifests when an attacker, possessing only the rebuildCache permission—a common right granted to many lower-level administrators—sends a POST request to the affected endpoint. By manipulating the request body to include arbitrary values for the job class and actor user ID fields, the attacker can trick the system into executing an approval queue action under the guise of another user account. The application logic accepts these parameters without validating that the current session holder is authorized to perform such actions or that they are acting on behalf of the specified actor in a legitimate context.
From an operational perspective, this flaw enables unauthorized modification of critical moderation workflows. An attacker can approve queued user registrations without holding the necessary approval-queue permissions, effectively bypassing security controls designed to prevent mass account creation by malicious actors. Furthermore, because the system attributes these actions to the impersonated actor ID provided in the request, the resulting moderation logs will falsely indicate that a legitimate administrator or moderator performed the action. This not only compromises the integrity of audit trails but also obscures the true source of the attack, making forensic analysis and attribution more difficult for security teams monitoring the platform.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves a user gaining privileges they are not explicitly granted through parameter manipulation rather than direct permission escalation. Additionally, from an offensive cybersecurity framework perspective, this behavior is consistent with ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to perform actions outside their intended scope. The ability to impersonate other users during administrative tasks also touches upon aspects of identity spoofing within the application's internal logic.
To mitigate this risk, organizations running XenForo must immediately upgrade to version 2.3.13 or later, which contains patches addressing these authorization gaps in the cache-rebuild dispatcher and related job handlers. Until an update can be applied, administrators should restrict the rebuildCache permission to only those users who absolutely require it for system maintenance, thereby reducing the attack surface available to potential adversaries. Implementing strict input validation on server-side endpoints that handle administrative jobs is also recommended as a defense-in-depth measure to ensure that actor IDs and job classes are validated against the actual permissions of the authenticated session holder rather than accepting arbitrary inputs blindly.