XenForo CVE-2026-73318

Exploitation requires an authenticated ACP administrator account - any account with ACP access qualifies, even one whose role explicitly lacks the option permission for the force-agreement feature. The administrator must be able to reach the XenForo ACP over the network. The vulnerability is present in all XenForo installations prior to 2.3.13 regardless of specific site configuration. Limiting factors: standard forum members and unauthenticated users cannot exploit this; it requires an insider or compromised admin credential. The impact is constrained to operational disruption (forced user re-consent) rather than data exfiltration or code execution.

Real-world risk is constrained by the requirement for an existing, authenticated ACP administrator account (CVSS PR:H), which limits the attacker pool significantly - exploitation is not possible by unauthenticated users or standard forum members. The CVSS 4.0 score of 5.1 accurately reflects this: the attack is network-reachable but requires high privilege. The impact is limited to integrity and availability disruption (VI:L/VA:L): the attacker can force all users to re-agree to policies, causing operational disruption and potential user confusion, but cannot read sensitive data or execute code. Even a mid-sized municipal IT team in sopot deploying XenForo for community engagement should treat this as a routine patch priority rather than an emergency, unless their ACP contains adversarial or untrusted administrator accounts. EPSS data is not provided; given the high privilege requirement and moderate impact, opportunistic mass exploitation is unlikely. No KEV listing and no publicly available exploit code further support a measured rather than urgent response posture.

An ACP administrator account with limited permissions - for example, a moderator elevated to a restricted admin role without the force-agreement option permission - navigates directly to the force-agreement controller URL or crafts a direct POST request to it. Despite lacking the configured option permission, the server processes the submission and updates the global policy timestamp, immediately prompting all forum users to re-accept the privacy policy or terms of service on their next visit. No public exploit code exists for this scenario.