---
id: CVE-2026-73320
title: >-
  XenForo before 2.3.13 contains an unauthenticated information disclosure
  vulnerability that allows unauthenticated attackers to retrieve private unfurl
  records by supplying predictable auto-increment primary key IDs to the unfurl
  endpoin…
summary: >-
  XenForo before 2.3.13 contains an unauthenticated information disclosure
  vulnerability that allows unauthenticated attackers to retrieve private unfurl
  records by supplying predictable auto-increment primary key IDs to the unfurl
  endpoin…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-639
vendor: xenforo
product: xenforo
affected:
  - xenforo < 2.3.13
patched:
  - xenforo 2.3.13
published: '2026-09-08'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T20:30:06.430'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73320'
references:
  - url: 'https://bombobombone.github.io/posts/cve-2026-73320/'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/BomboBombone/CVE-2026-73320'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpoint
    label: disclosure@vulncheck.com
  - url: >-
      https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
    label: disclosure@vulncheck.com
  - url: >-
      https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00362
epssPercentile: 0.27294
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/BomboBombone/CVE-2026-73320'
  checkedAt: '2026-09-25T08:21:11.614Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T13:40:48.936566Z'
ingestedAt: '2026-09-08T15:33:26.985Z'
---

## Overview

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content.

## Affected

- `xenforo < 2.3.13`

## Remediation

Upgrade past the affected range:

- `xenforo 2.3.13`