Description

XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation configuration to update the global policy last-updated timestamp, forcing all users to re-agree to the privacy policy or terms of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-09-08T14:17:26.197Z",
  "pubdate": "2026-09-08T14:17:26.197Z",
  "executiveSummary": "A missing authorization vulnerability has been identified in XenForo versions prior to 2.3.13. This security flaw resides within the platform's 'force-agreement' controller, which is responsible for managing user agreements regarding the terms of service and privacy policies.\nDue to a failure in enforcing proper permission checks, any administrator with Admin Control Panel (ACP) access can access and submit force-agreement forms, completely bypassing the permission restrictions declared in the navigation configuration.\nConsequently, an attacker with low-privilege ACP access can execute unauthorized changes, specifically updating the global policy's last-updated timestamp. This action forces all registered forum users to re-agree to the privacy policy or terms of service upon their next interaction with the site. The vulnerability undermines the system's role-based access control (RBAC) model by failing to restrict sensitive controller actions to authorized administrative accounts. Exploitation requires administrative access to the ACP but does not require high-level permissions, enabling administrative disruption within the affected XenForo environment.",
  "technicalDetails": "The vulnerability exists due to a missing authorization check within the force-agreement controller of XenForo prior to version 2.3.13. In a secure implementation, access control must be enforced at both the user interface level (such as hiding navigation links) and the controller level (verifying session permissions before executing controller actions). XenForo utilizes a navigation configuration system that declares specific option permissions required to view and access various administrative panels. This design ensures that unauthorized links are omitted from the user interface. However, relying solely on UI-level navigation configurations for security creates a vulnerability if the underlying controller does not mirror these authorization checks. In the case of the force-agreement controller, this authorization was only declared and enforced at the navigation layer.\nBecause the force-agreement controller itself lacked explicit permission checks within its execution lifecycle, any authenticated Admin Control Panel (ACP) user could bypass the navigation constraints. An attacker with restricted administrative privileges can bypass the UI by directly crafting and sending HTTP requests to the controller's endpoints.\nWhen the controller receives the unauthorized request to submit a force-agreement form, it fails to perform an independent server-side check of the administrator's assigned privileges. Instead, it processes the request as valid. The primary action of this submission is to update the global policy last-updated timestamp within the database.\nThe attack flow occurs as follows:\n1. The attacker authenticates to the XenForo Admin Control Panel with any level of administrative privileges, even if those privileges restrict access to global policy options.\n2. The attacker identifies or constructs the direct URL or endpoint mapped to the force-agreement controller.\n3. The attacker submits a crafted HTTP request, such as a POST request containing the force-agreement update parameters, to the controller.\n4. The force-agreement controller processes the request without validating the attacker's administrative privileges against the option permission declared in the navigation configuration.\n5. The application updates the global configuration, modifying the timestamp that tracks when the terms of service or privacy policy were last updated.\n6. Consequently, XenForo's session and middleware logic detects the new global timestamp and invalidates the agreement status for all registered users, forcing every user visiting the forum to immediately re-agree to the terms or privacy policy before they can continue using the platform.\nThis vulnerability represents a breakdown of the principle of least privilege, allowing lower-privileged administrators to perform actions reserved for higher-privileged administrators, resulting in potential disruption of forum operations and user workflows."
}