A critical authorization vulnerability in XenForo 2.3 versions before 2.3.5 allows OAuth2 clients to exceed their intended permissions, posing a significant risk to data confidentiality and integrity.

The software suffers from an Incorrect Authorization (CWE-863) vulnerability where OAuth2 client applications can request scopes beyond their authorized limits. An authenticated user or malicious client application can exploit this to gain elevated access to system resources.

The ability for OAuth2 clients to request unauthorized scopes may lead to the exfiltration of sensitive user data or unauthorized administrative actions within the forum environment. Given the CVSS score of 8.8, this flaw presents a high risk to organizational security, potentially resulting in data breaches and a loss of user trust.

Immediate Action: Administrators must upgrade their XenForo installation to version 2.3.5 or later to resolve the authorization logic error.

Proactive Monitoring: Security teams should review OAuth2 client logs and audit authorized scopes for all connected applications to detect any abnormal permission requests.

Compensating Controls: While no direct virtual patch exists, strictly limiting the number of registered OAuth2 clients and auditing their access permissions can reduce the attack surface.

Public Exploit Available: No (exploit_available: false).

The vulnerability represents a significant risk to the security of user data hosted on XenForo platforms. Organizations should prioritize the update to version 2.3.5 immediately to ensure that OAuth2 authorization scopes are correctly enforced and to prevent potential unauthorized access.