low advisory October 30, 2026

XenForo: Broken access control in ForceAgreementController (CVE-2026-73318)

XenForo versions prior to 2.3.13 contain an authorization bypass vulnerability (CVE-2026-73318) allowing low-privileged administrative users to trigger site-wide user re-agreement workflows.

Triage facts

Revision 1

Applicability: XenForo (< 2.3.13)
Evidence: Unknown
Severity: Low
Action: Elevated
Sources: 2 public sources
Freshness: Revision 1Oct 30, 22:04 UTC
Vulnerabilities: 1 CVE
Source quality: B3Likely

CVE-2026-73318 is an authorization bypass vulnerability affecting the ForceAgreementController in XenForo versions before 2.3.13. The vulnerability allows an administrator with limited ACP access - who lacks the specific 'option' permission - to access and execute site-wide policy and terms re-agreement workflows. This action resets global policy acceptance timestamps, forcing all board users to re-agree to terms. The vulnerability does not permit the modification of policy text.

Impact

Successful exploitation allows a low-privileged administrator to disrupt user activity by forcing site-wide re-agreement gates. This does not provide full system compromise or unauthorized access to user data beyond triggering the UI agreement prompt.

Recommendation

Patch XenForo immediately by upgrading to version 2.3.13 or later.
Audit ACP administrator permissions to ensure only authorized personnel hold the 'option' capability.
Monitor ACP administrative access logs for unauthorized attempts to access ForceAgreementController endpoints.

Immediate actions

Upgrade XenForo to 2.3.13 or later

IT Operations 48h

Threat Hunt

Identify ACP administrators accessing ForceAgreementController endpoints without sufficient permissions

T1068 medium medium confidence hunt now

Data: XenForo application logs / Web server access logs

Mitigations

Apply XenForo 2.3.13 patch

immediate IT Operations

CVE-2026-73318