CVE-2026-73318: XenForo Authorization Bypass Vulnerability

CVE-2026-73318 Overview

CVE-2026-73318 is a missing authorization vulnerability [CWE-863] in XenForo versions prior to 2.3.13. The flaw resides in the force-agreement controller within the Admin Control Panel (ACP). Any authenticated ACP administrator can access and submit force-agreement forms regardless of the permissions assigned to their account. Attackers abuse this to bypass the option permission declared in the navigation configuration and update the global policy last-updated timestamp. This action forces every user of the forum to re-agree to the privacy policy or terms of service.

Critical Impact
A low-privileged ACP administrator can trigger a forum-wide re-agreement prompt, disrupting user access and undermining the integrity of the community's policy acceptance records.

Affected Products

XenForo versions 2.2.0 through 2.3.12
XenForo Media Gallery versions 2.2.0 through 2.3.12
Fixed in XenForo 2.3.13

Discovery Timeline

2026-09-08 - CVE-2026-73318 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-73318

Vulnerability Analysis

The vulnerability is a broken access control issue in the XenForo ACP force-agreement controller. XenForo uses a navigation configuration to declare option permissions that gate which administrator accounts can access particular admin functions. The force-agreement controller does not enforce the option permission declared in that navigation configuration. As a result, permission checks are effectively bypassed when the controller endpoint is accessed directly. Any ACP-authenticated administrator, including those with narrow or delegated permissions, can render the force-agreement form and submit it.

Submitting the form updates the global policy last-updated timestamp used by XenForo to determine whether users have accepted the current privacy policy and terms of service. Once the timestamp advances, every user session is interrupted with a re-agreement prompt on their next request. The impact is limited to integrity and availability of the policy-acceptance workflow, not confidentiality of stored data.

Root Cause

The root cause is a missing authorization check in the force-agreement controller. The controller relies on the ACP navigation layer to enforce the option permission, but never validates the permission on the request handler itself. Attackers who can reach the controller URL directly are never checked against the declared permission, violating the principle of complete mediation.

Attack Vector

Exploitation is performed over the network by any user holding valid ACP administrator credentials, including accounts intentionally scoped to a narrow set of options. The attacker navigates directly to the force-agreement controller endpoint in the ACP, submits the form, and the backend accepts the request. No user interaction from other administrators or forum members is required. Because the endpoint is reachable through the standard ACP interface, no custom tooling is needed to trigger the condition.

Technical write-ups describing the request flow and the missing permission gate are available in the VulnCheck XenForo Advisory and the BomboBombone CVE-2026-73318 Post.

Detection Methods for CVE-2026-73318

Indicators of Compromise

Unexpected changes to the global policy last-updated timestamp in the XenForo options table, especially outside planned policy revisions.
ACP audit log entries showing access to the force-agreement controller by administrator accounts not responsible for legal or policy management.
User-facing reports of unexpected privacy policy or terms-of-service re-agreement prompts across the forum.

Detection Strategies

Review XenForo ACP action logs for requests targeting the force-agreement controller and correlate them with the acting administrator's assigned permissions.
Alert when the global policy last-updated option value changes without a corresponding change-management record.
Compare the XenForo installation version against 2.3.13 to identify unpatched instances during routine asset inventory sweeps.

Monitoring Recommendations

Ingest XenForo application and web server logs into a centralized analytics platform to correlate ACP activity with administrator identity.
Monitor administrator authentication events and flag ACP logins that immediately access the force-agreement endpoint.
Track policy-acceptance metrics for anomalous spikes in re-agreement events, which often indicate abuse of this endpoint.

How to Mitigate CVE-2026-73318

Immediate Actions Required

Upgrade XenForo and XenForo Media Gallery to version 2.3.13 or later, following the XenForo 2.3.13 Security Fixes Release notes.
Audit all ACP administrator accounts and remove any that are no longer required, prioritizing accounts with weak authentication.
Review recent changes to the global policy last-updated timestamp and validate that each change was authorized.

Patch Information

XenForo released version 2.3.13 with fixes for this issue, along with backport patches for supported branches. Refer to the XenForo Security Fixes Announcement for the full list of impacted versions and update guidance. The patch adds enforcement of the option permission at the controller layer so that the check is performed on every request.

Workarounds

Restrict ACP access at the network layer to trusted IP ranges or via VPN until the patch is applied.
Reduce the number of administrator accounts with any ACP access and enforce multi-factor authentication on all remaining accounts.
Temporarily remove the force-agreement navigation entry for non-essential administrator groups if the patch cannot be applied immediately.

bash

# Configuration example: verify installed XenForo version
grep -R "XF::VERSION_ID" /path/to/xenforo/src/XF.php

# Restrict ACP access by IP at the web server (nginx example)
location /admin.php {
    allow 10.0.0.0/24;
    deny all;
}