A flaw in XenForo’s OAuth2 implementation permits client applications to request scopes that have not been authorized by the end user. By exploiting this vulnerability, a malicious client can gain access to privileged resources or functions beyond its intended level, potentially exposing sensitive data or administrative controls.

All XenForo installations running the 2.3 series prior to version 2.3.5 that employ OAuth2 clients are affected. This includes any deployment that relies on OAuth2 for authentication and authorization, regardless of the specific configuration of the application or server.

The CVSS score of 8.7 classifies the issue as high severity. EPSS data is unavailable, but the vulnerability can be triggered remotely by an attacker who can send OAuth2 scope requests to the target. The absence of a listing in CISA’s KEV catalog indicates no confirmed exploits yet, yet the potential for privilege escalation means the risk remains significant for users running vulnerable versions.