Multiple XenForo Flaws Expose Forums to RCE, Scope Abuse, and Template Bypass
Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Apr 1, 2026
XenForo disclosed and patched three high-severity vulnerabilities affecting multiple 2.2 and 2.3 releases, including remote code execution, OAuth2 authorization abuse, and a template method call restriction bypass. The most severe issue, CVE-2026-35056, allows an authenticated but malicious administrator with admin control panel access to execute arbitrary code on the server, affecting versions before 2.3.9 and 2.2.18. The flaw is classified as CWE-94 and carries a high-impact CVSS vector indicating compromise of confidentiality, integrity, and availability.
Two additional XenForo flaws affect authorization controls in the platform. CVE-2025-71278 impacts versions before 2.3.5 and allows OAuth2 client applications to request unauthorized scopes, potentially granting access beyond intended permissions; it is mapped to CWE-863. CVE-2025-71281 affects versions before 2.3.7 and stems from a loose prefix match in template callback and variable method-call handling, enabling unauthorized method invocation from templates. XenForo addressed the issues in security releases 2.3.5, 2.3.7, 2.3.9, and 2.2.18, with advisories also published by VulnCheck.
