CVE-2026-51833: SSRF
Published Jul 17, 2026
·Updated
Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can enumerate internal services (ports) or expose the original IP address of the server.
Affected Software
1 affected component
XenForo XenForo 2.3.8=2.3.8
Event History
Jul 17, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs administrator privileges or the ability to add or save RSS feeds. It is therefore most relevant where RSS feed creation or editing is delegated beyond fully trusted administrators.
2
What can an attacker do through the SSRF flaw?
The issue can be used to enumerate internal services and ports. It may also expose the server's original IP address.
3
Are unauthenticated external attackers affected by default?
The available information does not describe unauthenticated exploitation. It specifically states that exploitation requires administrator privileges or permission to add or save RSS feeds.