## https://sploitus.com/exploit?id=E48CF118-ADF8-5A17-8001-B36FEBDE6FE2
# CVE-2026-73318
XenForo before 2.3.13 lets any ACP administrator trigger site-wide privacy-policy and terms re-agreement.
## What happens
The ACP navigation entries are limited to administrators with the `option` permission, but `ForceAgreementController` does not enforce that permission. Direct requests from any authenticated ACP administrator reach both forms and their state-changing POST actions.
The actions update the global policy timestamps. Users whose recorded acceptance predates those values are forced through the corresponding agreement gate. The bug does not let the limited administrator edit the policy text; it lets them trigger the board-wide re-agreement workflow outside their assigned role.
I reproduced this on XenForo 2.3.12 (build 2031270) with a non-super administrator holding only an unrelated ACP permission. The account received HTTP 403 from Options but HTTP 200 from both force-agreement routes. XenForo 2.3.13 contains the fix.
## Proof of concept
```bash
python poc.py https://xenforo.example LIMITED_ADMIN --confirm
```
The password is read with a hidden prompt. This changes two global timestamps. Use an isolated board, record the original values, and restore them after testing.
## References
- [CVE record](https://vulners.com/cve/CVE-2026-73318)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-missing-authorization-via-force-agreement-controller)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
Discovered by Marco Paciaroni (BomboBombone).