BomboBombone.exe My test administrator had one ACP permission: rebuild caches. Opening the approval queue returned 403. Sending the approval job through the rebuild endpoint approved the waiting user anyway.
The moderator log attributed the action to the privileged account named in the request.
An overly general rebuild endpoint
The rebuild controller accepted a job class and its options from the request, checked rebuildCache and manual-trigger support, then dispatched the job.
XF:ApprovalQueueProcess was one of those jobs. Its options included asUserId, so the restricted administrator could choose the identity used for the approval.
A direct request to the approval queue returned 403. Dispatching XF:ApprovalQueueProcess through ToolsController::actionRebuild() approved the same waiting user. The missing check was at the dispatcher, which treated a cache-maintenance permission as permission to launch any manually triggerable job.
The public PoC performs both requests and verifies the user’s state afterward. XenForo restricted the dispatcher in 2.3.13.