# CVE-2026-73317: XenForo authorization bypass in ACP cache-rebuild dispatcher

Source: https://junglewise.ai/threats/cve-2026-73317-xenforo-authorization-bypass-in-acp-cache-rebuild-dispatcher  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73317 · Severity: low · CVSS 2.7 · Published 2026-09-08

XenForo is a popular web forum and community platform. A security flaw in the admin control panel's cache-rebuild feature allows limited administrators with only cache-rebuild permissions to approve pending user registrations without having the proper approval permissions, and falsely attribute those actions to other administrator accounts. This could undermine moderation oversight and create confusion about who performed critical account approvals.

## Quick answers

**Is CVE-2026-73317 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73317 being exploited in the wild.

**How severe is CVE-2026-73317?** Low severity, with a CVSS score of 2.7, published 8 September 2026.

**Which products and versions are affected?** XenForo XenForo before 2.3.13.

**Is there a fix for CVE-2026-73317?** A patch was published on 2026-09-08: XenForo 2.3.13 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73317 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73317?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check in the ACP ToolsController::actionRebuild() method. The endpoint accepts a caller-supplied job class name and options, but only verifies that the job declares itself as manually triggerable (via the rebuildCache permission check). It does not verify that the administrator has permission to perform the action implemented by the selected job. The XF:ApprovalQueueProcess job accepts both an action (approve/deny) and an asUserId parameter; when dispatched through the rebuild endpoint, the job executes under the impersonated user's identity. An attacker must be an authenticated ACP administrator with the rebuildCache permission. By supplying XF:ApprovalQueueProcess with the target moderated user ID and desired asUserId (to forge the moderation log), they can approve pending registrations and attribute them to another account. XenForo 2.3.13 restricts which jobs can be dispatched through the rebuild endpoint.

## Affected products

- XenForo XenForo before 2.3.13

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: patched: XenForo 2.3.13 released with fix

## References

- [https://bombobombone.github.io/posts/cve-2026-73317/](https://bombobombone.github.io/posts/cve-2026-73317/)
- [https://github.com/BomboBombone/CVE-2026-73317](https://github.com/BomboBombone/CVE-2026-73317)