Is CVE-2026-73318 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-73318?

CVE-2026-73318 has a CVSS v3 severity of LOW (3.8).

Back

CVE-2026-73318

Description

XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation configuration to update the global policy last-updated timestamp, forcing all users to re-agree to the privacy policy or terms of service.