BomboBombone.exe XenForo hides its privacy-policy and terms reset controls from administrators who lack the option permission. I logged in as one of those restricted administrators and posted to the hidden routes directly. Both returned 200.
Every account on the board was then asked to accept the agreements again.
The permission stopped at the menu
The ACP navigation checked option before showing the controls. ForceAgreementController skipped the permission when handling the request.
Those actions leave the policy text alone and update the global agreement timestamps. Changing either timestamp invalidates every existing acceptance, interrupting the board from an administrator role that excludes the settings area.
The public PoC signs in with a restricted ACP account, submits both requests, and checks the timestamps.
XenForo added the missing controller permission in 2.3.13.