CVE-2026-73318
XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation configuration to update the global policy last-updated timestamp, forcing all users to re-agree to the privacy policy or terms of service.
- Published Sep 8, 2026
- CVSS 5.1 medium
- 0.5% chance of exploitation in the next 30 days (EPSS)
- Public exploit code is available
- A fix is available