CVE-2025-71281 - Vulnerability Analysis

Overview

XenForo < 2.3.7 contains a broken access control vulnerability caused by improper restriction of callable methods in templates, letting attackers invoke unauthorized methods, exploit requires template access.

Severity & Score

Impact

Attackers can invoke unauthorized methods, potentially leading to unauthorized actions or data access.

Mitigation

Upgrade to version 2.3.7 or later.

References

• https://www.vulncheck.com/advisories/xenforo-template-method-call-restriction-bypass
• https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner