XenForo 2.3.12 build 2031270 allowed a restricted admin control panel user without the option permission to reset the board-wide privacy-policy and terms acceptance timestamps. The affected actions returned HTTP 200 even though their controls were hidden from that administrator.
Technical details
The ACP navigation checked option before showing the controls. ForceAgreementController never repeated that check when it handled the request.
The routes update global agreement timestamps. Moving either timestamp forward invalidates every existing acceptance.
Reproduction
- Create an ACP administrator without the
option permission.
- Log in as that administrator and confirm that the agreement-reset controls are unavailable.
- Send direct POST requests to the privacy-policy and terms reset actions.
- Read the global agreement timestamps and open the board as an existing user.
Both requests returned HTTP 200 and advanced the corresponding timestamps. Existing users were required to accept the agreements again.
Impact
A restricted ACP administrator could force every board user to repeat the privacy-policy or terms acceptance flow, causing a board-wide interruption until each user completed it.
XenForo added the controller-level permission check in 2.3.13.
References
XenForo 2.3.12 build 2031270 allowed a restricted admin control panel user without the `option` permission to reset the board-wide privacy-policy and terms acceptance timestamps. The affected actions returned HTTP 200 even though their controls were hidden from that administrator.
## Technical details
The ACP navigation checked `option` before showing the controls. `ForceAgreementController` never repeated that check when it handled the request.
The routes update global agreement timestamps. Moving either timestamp forward invalidates every existing acceptance.
## Reproduction
1. Create an ACP administrator without the `option` permission.
2. Log in as that administrator and confirm that the agreement-reset controls are unavailable.
3. Send direct POST requests to the privacy-policy and terms reset actions.
4. Read the global agreement timestamps and open the board as an existing user.
Both requests returned HTTP 200 and advanced the corresponding timestamps. Existing users were required to accept the agreements again.
## Impact
A restricted ACP administrator could force every board user to repeat the privacy-policy or terms acceptance flow, causing a board-wide interruption until each user completed it.
XenForo added the controller-level permission check in 2.3.13.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73318)
- [PoC](https://github.com/BomboBombone/CVE-2026-73318)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-missing-authorization-via-force-agreement-controller)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe