CVE-2026-73320
XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
- State
- Published
- Severity
- 5.1 Medium
- Published
- Sep 8, 2026
- Updated
- Oct 1, 2026
- Reserved
- Aug 11, 2026
Description
XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
XenForoXenForo |
|
References
- Vendor Advisoryvendor-advisorypatch
- Release Notesrelease-notes
- Researcher Advisorytechnical-description
- Researcher PoCexploit
- https://www.vulncheck.com/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.