Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-73320XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint

Medium 6.1

In plain English

A medium-severity authorization bypass via user-controlled key in XenForo from XenForo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.4%top 69.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content.

Affected products (as reported)

Vendor	Product	Versions
XenForo	XenForo	0 – before 2.3.13

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Vendor Advisory vendor-advisory, patch
Release Notes release-notes
Researcher Advisory technical-description
Researcher PoC exploit
https://www.vulncheck.com/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpoint third-party-advisory