bombobombone/cve-2026-73318Proof-of-concept exploit for XenForo CVE-2026-73318, an authorization bypass allowing ACP administrators to trigger site-wide policy re-agreement. Includes reproduction steps and a Python script.
XenForo before 2.3.13 lets any ACP administrator trigger site-wide privacy-policy and terms re-agreement.
The ACP navigation entries are limited to administrators with the option permission, but ForceAgreementController does not enforce that permission. Direct requests from any authenticated ACP administrator reach both forms and their state-changing POST actions.
The actions update the global policy timestamps. Users whose recorded acceptance predates those values are forced through the corresponding agreement gate. The bug does not let the limited administrator edit the policy text; it lets them trigger the board-wide re-agreement workflow outside their assigned role.
I reproduced this on XenForo 2.3.12 (build 2031270) with a non-super administrator holding only an unrelated ACP permission. The account received HTTP 403 from Options but HTTP 200 from both force-agreement routes. XenForo 2.3.13 contains the fix.
python poc.py https://xenforo.example LIMITED_ADMIN --confirm
The password is read from a prompt. The script compares access to the Options page with both force-agreement actions.
Discovered by Marco Paciaroni (BomboBombone).