CVE-2026-73320CWE-639

CVE-2026-73320

Medium · published September 8, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00362 · 28.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-08T18:17Z
Affected products (1)
ProductVersionsFixed in
xenforo/xenforo< 2.3.132.3.13
References (5)
https://bombobombone.github.io/posts/cve-2026-73320/ · [email protected]https://github.com/BomboBombone/CVE-2026-73320 · [email protected]https://www.vulncheck.com/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpoint · [email protected]https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/ · [email protected]https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/ · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 13:19Z
    XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
    cvelistv5