bombobombone/cve-2026-73317Proof-of-concept exploit and technical write-up for CVE-2026-73317, an authorization bypass in XenForo allowing limited admins to approve content as another user via the ACP cache-rebuild dispatcher.
XenForo before 2.3.13 lets an administrator with only the cache-rebuild permission dispatch an approval job as another user.
The ACP rebuild endpoint accepts a caller-supplied job class and options. Its authorization check asks only whether the chosen job declares itself user-triggerable. XF:ApprovalQueueProcess passes that check and accepts both an approval action and an asUserId value.
The job executes inside XF::asVisitor() as the selected account. A limited administrator can therefore approve queued content without approval-queue or moderator permission, and the moderation log attributes the action to the impersonated user.
I reproduced the minimal case on XenForo 2.3.12 (build 2031270): a non-super administrator with only rebuildCache could not open the approval queue but approved one disposable moderated user through the hidden job. XenForo 2.3.13 contains the fix.
python poc.py https://xenforo.example LIMITED_ADMIN AS_USER_ID DISPOSABLE_MODERATED_USER_ID --confirm
The password is read with a hidden prompt. The script performs one state-changing approval, so use only disposable users and review the moderator log afterward.
Discovered by Marco Paciaroni (BomboBombone).