CVE-2026-73318 XenForo < 2.3.13 Missing Authorization via force-agreement Controller
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-73318?
CVE-2026-73318 is a medium-severity vulnerability in XenForo, published on 8 Sep 2026.
Official description
XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation configuration to update the global policy last-updated timestamp, forcing all users to re-agree to the privacy policy or terms of service.
Weakness: CWE-863
Which versions are affected by CVE-2026-73318?
It affects 1 product.
Products include Xenforo Xenforo.
How do I fix CVE-2026-73318?
No fix has been published for CVE-2026-73318 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73318 being exploited?
There is no known exploitation of CVE-2026-73318 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in XenForo
- CVE-2025-71279 XenForo Passkey Security Bypass
- CVE-2026-73309 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
- CVE-2026-73311 XenForo < 2.3.13 OAuth2 Authorization Code Reuse
- CVE-2026-73312 XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
- CVE-2024-38457 Xenforo before 2.2.16 allows CSRF.
Sources
Also known as GHSA-gw9m-qhxg-fr69.