XenForo EUVD-2026-72754

Exploitation requires a valid XenForo admin account with at least the rebuildCache ACP permission explicitly granted-this is a non-default, restricted permission not available to standard registered users, moderators, or unauthenticated visitors. For the approval queue job to produce meaningful impact, pending user registrations must exist in the moderation queue at the time of exploitation. The CVSS PR:H metric confirms a high-privilege account is required. The principal limiting factor is the requirement for a legitimate, authenticated admin credential with the specific rebuildCache permission, confining exploitation to insiders or scenarios where an admin account has been separately compromised.

The CVSS 4.0 score of 5.1 (Medium), vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N, accurately reflects the constrained real-world risk. Exploitation requires a valid XenForo admin account with at least the rebuildCache permission-a non-default, restricted role not granted to ordinary forum users or moderators-substantially limiting the attacker population to insiders or compromised admin accounts. Impact is bounded to unauthorized approval of queued user registrations and audit log impersonation (VI:L), with no confidentiality or availability impact confirmed by the vector. No CISA KEV listing and no public exploit code are present in the input data, further reducing urgency for most deployments. SSVC assessment: Exploitation=None, Automatable=Yes once valid credentials are obtained, Technical Impact=Partial. This is a genuine but low-urgency insider-trust and privilege-segregation issue rather than a perimeter-facing threat.

A disgruntled or compromised XenForo admin holding only the rebuildCache permission crafts a POST request to the ACP cache-rebuild dispatcher, specifying the approval queue job class and a senior administrator's user ID as the actor. The dispatcher executes the job without verifying the caller's authorization for that job class, silently approving all pending user registrations. The moderation log records the actions under the impersonated senior administrator's account, masking the true origin.