CVE-2026-73320 json
XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
published 2026-09-08 2 mo ago modified 2026-10-01 39 d ago also EUVD-2026-72757
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content.
Patch / fix
- XenForo XenForo 2.3.13
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/BomboBombone/CVE-2026-73320 referenced PoC, tagged "exploit" by a source, unverified
- bombobombone.github.io https://bombobombone.github.io/posts/cve-2026-73320/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- XenForo XenForo
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
xenforo.com
/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
vendor-advisory, patch, release-notes
-
github.com
/BomboBombone/CVE-2026-73320
exploit, third-party-advisory
-
bombobombone.github.io
/posts/cve-2026-73320/
technical-description, exploit, third-party-advisory
-
xenforo.com
/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/
release-notes
-
vulncheck.com
/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpoint
third-party-advisory
Sources
- CVE List CVE-2026-73320
- NVD CVE-2026-73320
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.