XenForo 2.3.12 build 2031270 allowed a restricted admin control panel user with the rebuildCache permission to run an approval-queue job as another user. The restricted administrator could approve a pending account despite receiving HTTP 403 from the normal approval route.
Technical details
The controller accepted a job class and its options, checked rebuildCache plus manual-trigger support and dispatched it. XF:ApprovalQueueProcess happened to be manually triggerable, and one of its options was asUserId.
ToolsController::actionRebuild() did not check whether the administrator had permission to perform the action implemented by the selected job. The request controlled both the job class and the user identity supplied through asUserId.
Reproduction
- Create an ACP administrator with only the cache-rebuild permission.
- Create or identify a user waiting in the approval queue.
- Confirm that the restricted administrator receives HTTP 403 from the normal approval action.
- Submit
XF:ApprovalQueueProcess through the rebuild endpoint with the target account and a privileged asUserId value.
- Check the target account and moderator log.
The job approved the account. The moderator log attributed the action to the user supplied through asUserId.
Impact
A restricted ACP administrator could execute approval-queue actions outside their assigned permissions and attribute those actions to another account.
XenForo restricted the rebuild-job dispatcher in 2.3.13.
References
XenForo 2.3.12 build 2031270 allowed a restricted admin control panel user with the `rebuildCache` permission to run an approval-queue job as another user. The restricted administrator could approve a pending account despite receiving HTTP 403 from the normal approval route.
## Technical details
The controller accepted a job class and its options, checked `rebuildCache` plus manual-trigger support and dispatched it. `XF:ApprovalQueueProcess` happened to be manually triggerable, and one of its options was `asUserId`.
`ToolsController::actionRebuild()` did not check whether the administrator had permission to perform the action implemented by the selected job. The request controlled both the job class and the user identity supplied through `asUserId`.
## Reproduction
1. Create an ACP administrator with only the cache-rebuild permission.
2. Create or identify a user waiting in the approval queue.
3. Confirm that the restricted administrator receives HTTP 403 from the normal approval action.
4. Submit `XF:ApprovalQueueProcess` through the rebuild endpoint with the target account and a privileged `asUserId` value.
5. Check the target account and moderator log.
The job approved the account. The moderator log attributed the action to the user supplied through `asUserId`.
## Impact
A restricted ACP administrator could execute approval-queue actions outside their assigned permissions and attribute those actions to another account.
XenForo restricted the rebuild-job dispatcher in 2.3.13.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73317)
- [PoC](https://github.com/BomboBombone/CVE-2026-73317)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-missing-authorization-via-acp-cache-rebuild-dispatcher)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe