CVE-2026-73317

CVE-2026-73317: Approval job authorization bypass XenForo before 2.3.13 lets an administrator with only the cache-rebuild permission dispatch an approval job as another user. What happens The ACP rebuild endpoint accepts a caller-supplied job class and options. Its authorization check asks only...