Description

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body. Attackers can invoke the approval queue job under any user identity to approve queued user registrations without holding the required approval-queue or moderator permissions, causing the moderation log to attribute actions to an impersonated account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-08T14:17:26.060Z",
  "pubdate": "2026-09-08T14:17:26.060Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are susceptible to a missing authorization vulnerability within the ACP (Admin Control Panel) cache-rebuild dispatcher.\nThis security flaw allows an attacker with limited administrative access, specifically those holding only the 'rebuildCache' permission, to bypass authorization controls.\nBy manipulating the POST body to supply an arbitrary job class and actor user ID, an attacker can trigger unauthorized actions within the approval queue.\nThe vulnerability effectively allows an unprivileged actor to approve queued user registrations by impersonating other administrative accounts.\nThe impact is significant as it facilitates unauthorized account creation and provides a mechanism for identity impersonation in system audit logs, undermining the integrity of the moderation process.\nExploitation requires the attacker to possess legitimate but restricted administrative credentials, specifically the rebuildCache permission.\nThis vulnerability highlights a failure in the input validation and access control logic governing the cache rebuild dispatching mechanism, posing a critical risk to platform integrity and administrative accountability.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper access control check within the ACP cache-rebuild dispatcher, which fails to validate the authorization context of the provided job class and actor parameters.\nIn XenForo, the cache rebuild mechanism is designed to allow administrators to trigger background tasks. However, the dispatcher inadequately verifies whether the user initiating the request possesses the requisite permissions to execute the specific class of job provided in the payload.\nThe attack flow begins when an authenticated administrator with the 'rebuildCache' permission sends a crafted POST request to the dispatcher. By specifying an arbitrary job class—specifically one associated with the approval queue—and injecting a target actor user ID, the attacker manipulates the backend logic.\nNormally, approving queued user registrations requires elevated 'approval-queue' or 'moderator' permissions. In this attack scenario, the vulnerable component blindly trusts the user-supplied actor ID, allowing the system to execute the approval job contextually as that user. Consequently, the application bypasses the standard permission checks because it assumes the identity passed in the request is valid and authorized for the task.\nThe payload behaves by tricking the system into executing a routine that evaluates and approves pending registrations. Because the job is performed under the identity of the impersonated user, the system's internal moderation logs record the action as if the impersonated administrative account had performed it, effectively laundering the unauthorized approval action.\nThis vulnerability is restricted to environments where the attacker already maintains administrative access to the ACP; however, it effectively elevates their privileges by allowing them to perform administrative actions they are strictly forbidden from executing otherwise. The lack of validation on the user-supplied job class and actor user ID within the dispatching function confirms a failure in server-side authorization enforcement.\nAffected systems include all XenForo installations running versions prior to 2.3.13. No specific network exposure is required beyond access to the administrative interface, as the flaw is strictly confined to the internal logic of the ACP dispatcher."
}