Medium severity6.1NVD Advisory· Published Sep 8, 2026
CVE-2026-73320
CVE-2026-73320
Description
XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
3- www.vulncheck.com/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpointnvd
- xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/nvd
- xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/nvd
News mentions
0No linked articles in our index yet.