CVE-2026-73317

XenForo before 2.3.13 contains a missing authorization flaw (CWE-863) in the Admin Control Panel cache-rebuild dispatcher, allowing a restricted administrator to exceed their assigned permissions. An administrator holding only the rebuildCache permission can send a crafted POST request to the cache-rebuild endpoint specifying an arbitrary job class and any actor user ID, causing the approval-queue job to run under an impersonated identity. This lets the attacker approve queued user registrations without holding the required approval-queue or moderator permissions, while the moderation log records the action as performed by the impersonated account. Only XenForo forums running versions prior to 2.3.13 are affected, and exploitation requires someone who already has at least this limited administrative access in the target forum. Exploitation is not currently widespread: the issue is not in CISA KEV, EPSS estimates only a 0.3% chance of exploitation in the next 30 days, and a single public proof-of-concept is available on GitHub.

What to do: Upgrade XenForo to version 2.3.13 or later. As interim mitigation, revoke the rebuildCache permission from limited administrators or restrict it to fully privileged admins until patching is complete. Review the moderation log for approval-queue actions attributed to accounts that lack moderator permissions, which would indicate the flaw was abused.