XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potentially allowing unauthorized method invocations.
| Vendor | Product | Versions |
|---|---|---|
| xenforo | xenforo | 2.3.0 |
Updated severity to CRITICAL, affected versions to include 2.3.6, and marked as actively exploited.
Initial creation
