Code injection via loose method-prefix matching

Code injection in XenForo 2.3.0 through 2.3.6 allows remote authenticated users to invoke unauthorized methods through templates. Callback and variable method-call validation accepts any method whose name loosely begins with an allowed prefix instead of matching its first word. Authenticated access to an attacker-influenced template evaluation path is required, and the vendor has not identified the otherwise blocked methods that become reachable.