CVE-2026-73318

XenForo versions before 2.3.13 contain a missing authorization check (CWE-863) in the admin control panel's force-agreement controller. Any administrator with ACP access can open and submit force-agreement forms even without the option permission declared in the navigation configuration, because that permission is not enforced in the controller itself. By submitting the form, the attacker updates the global policy last-updated timestamp, which forces every forum user to re-accept the privacy policy or terms of service on their next visit. The impact is limited to integrity (forced re-consent for all members); no data is exposed or destroyed, and the flaw requires an administrator-level login rather than unauthenticated access. There are no confirmed in-the-wild exploits, but a public proof-of-concept exists and EPSS estimates a 0.3% probability of exploitation within 30 days.

What to do: Upgrade XenForo to version 2.3.13 or later, where the force-agreement controller enforces the option permission directly. Until patched, restrict ACP access to fully trusted administrators and audit the global policy last-updated timestamp plus admin logs for unexpected force-agreement submissions. Note that exploitation requires an administrator account, so reviewing which users hold ACP access is the highest-value interim check.