CVE-2026-73317 XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

What is CVE-2026-73317?

CVE-2026-73317 is a medium-severity missing authorization vulnerability in XenForo, published on 8 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body. Attackers can invoke the approval queue job under any user identity to approve queued user registrations without holding the required approval-queue or moderator permissions, causing the moderation log to attribute actions to an impersonated account.

Weakness: CWE-863

Which versions are affected by CVE-2026-73317?

It affects 1 product.

Products include Xenforo Xenforo.

How do I fix CVE-2026-73317?

No fix has been published for CVE-2026-73317 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-73317 being exploited?

There is no known exploitation of CVE-2026-73317 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in XenForo

• CVE-2025-71279 XenForo Passkey Security Bypass Critical 9.3
• CVE-2026-73309 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint Critical 9.1
• CVE-2026-73311 XenForo < 2.3.13 OAuth2 Authorization Code Reuse Critical 9.1
• CVE-2026-73312 XenForo < 2.3.13 Refresh Token Replay via Expired Access Token Critical 9.1
• CVE-2024-38457 Xenforo before 2.2.16 allows CSRF. High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9j29-fqp6-x79p.