Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-73317XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

Low 2.7

In plain English

A low-severity incorrect authorization in XenForo from XenForo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.4%top 64.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body. Attackers can invoke the approval queue job under any user identity to approve queued user registrations without holding the required approval-queue or moderator permissions, causing the moderation log to attribute actions to an impersonated account.

Affected products (as reported)

Vendor	Product	Versions
XenForo	XenForo	0 – before 2.3.13

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

Vendor Advisory vendor-advisory, patch
Release Notes release-notes
Researcher Advisory technical-description
Researcher PoC exploit
https://www.vulncheck.com/advisories/xenforo-missing-authorization-via-acp-cache-rebuild-dispatcher third-party-advisory