Missing Authorization Vulnerability in XenForo Affected by Configuration Flaws
CVE-2026-73318

5.1MEDIUM

Key Information:

Vendor

Xen Projectforo

Status
Xen Projectforo
Vendor
CVE Published:
8 September 2026

What is CVE-2026-73318?

A vulnerability exists in XenForo that allows unauthorized access to the force-agreement controller for any ACP administrator. This security flaw enables attackers to bypass permission settings defined in the navigation configuration, allowing them to update the last-updated timestamp of global privacy policies or terms of service. This action forces all users to re-agree to policies without the necessary permissions, undermining user consent and security practices.

Affected Version(s)

XenForo 0 < 2.3.13

References

https://xenforo.com/community/threads/security-fixes-rele...
vendor-advisorypatch
https://xenforo.com/community/threads/xenforo-2-3-13-and-...
release-notes
https://www.vulncheck.com/advisories/xenforo-missing-auth...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Paciaroni (BomboBombone)
VulnCheck
.