CVE-2026-73318: XenForo < 2.3.13 Missing Authorization via force-agreement Controller
XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation configuration to update the global policy last-updated timestamp, forcing all users to re-agree to the privacy policy or terms of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
XenForoto a version that resolves this vulnerability.Fixed in 2.3.13 - Compensating control
Limit access to the XenForo ACP administrator functions to trusted users/roles (since the vulnerability allows any ACP administrator to access and submit force-agreement forms regardless of assigned permissions).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have ACP administrator access. The flaw lets any ACP administrator use the force-agreement forms even when their assigned permissions do not grant access to that option.
What is the practical impact of successful exploitation?
The attacker can update the global policy last-updated timestamp. This forces all users to re-agree to the privacy policy or terms of service.
Are installations before 2.3.13 affected?
The issue affects XenForo versions before 2.3.13. Updating to 2.3.13 or later addresses the affected version range described.