Executive brief
XenForo is a popular web forum and community platform. A security flaw in the admin control panel's cache-rebuild feature allows limited administrators with only cache-rebuild permissions to approve pending user registrations without having the proper approval permissions, and falsely attribute those actions to other administrator accounts. This could undermine moderation oversight and create confusion about who performed critical account approvals.
Technical details
The vulnerability is a missing authorization check in the ACP ToolsController::actionRebuild() method. The endpoint accepts a caller-supplied job class name and options, but only verifies that the job declares itself as manually triggerable (via the rebuildCache permission check). It does not verify that the administrator has permission to perform the action implemented by the selected job. The XF:ApprovalQueueProcess job accepts both an action (approve/deny) and an asUserId parameter; when dispatched through the rebuild endpoint, the job executes under the impersonated user's identity. An attacker must be an authenticated ACP administrator with the rebuildCache permission. By supplying XF:ApprovalQueueProcess with the target moderated user ID and desired asUserId (to forge the moderation log), they can approve pending registrations and attribute them to another account. XenForo 2.3.13 restricts which jobs can be dispatched through the rebuild endpoint.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: XenForo 2.3.13 released with fix