Quick answers
- Is CVE-2026-73318 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73318 being exploited in the wild.
- How severe is CVE-2026-73318?
- Low severity, with a CVSS score of 3.8, published 8 September 2026.
- Which products and versions are affected?
- XenForo XenForo before 2.3.13.
- Is there a fix for CVE-2026-73318?
- A patch was published on 2026-09: Fix included in XenForo 2.3.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73318 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-73318?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a missing authorization check in the ForceAgreementController. The ACP navigation interface correctly hides force-agreement controls from administrators lacking the "option" permission, but the controller itself does not enforce this permission check. An authenticated ACP administrator without the required permission can send direct POST requests to privacy-policy and terms reset endpoints, which return HTTP 200 and update global agreement timestamps. When timestamps advance, all existing user acceptances become invalid, forcing every user through the re-agreement flow. The fix, applied in XenForo 2.3.13, adds controller-level permission enforcement.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed: CVE-2026-73318 published
- 2026-09: patched: Fix included in XenForo 2.3.13