CVE-2026-73320: XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
XenForoto a version that resolves this vulnerability.Fixed in 2.3.13 - Compensating control
Ensure the XenForo unfurl endpoint does not expose private unfurl records to unauthenticated requests; enforce authentication and authorization checks (do not allow access without a session/user/visibility checks).
Event History
Frequently Asked Questions
Which deployments are exposed?
XenForo installations running a version before 2.3.13 are affected. The exposed data is limited to private unfurl records that exist on the installation, including records associated with private conversations or other restricted content.
What does an attacker need to exploit this issue?
An attacker needs only network access to the affected XenForo endpoint and a predictable or enumerable unfurl record ID. No account, session, or other authorization is required, although exploitation requires user interaction under the supplied severity vector.
What information can be retrieved?
An attacker can obtain rendered preview HTML, the original URLs, and query strings stored in private unfurl records. Query strings may contain sensitive values if they were present in the original URL.
How can administrators determine whether they may already be affected?
Administrators should identify whether their XenForo version is earlier than 2.3.13 and whether private or restricted content has generated unfurl records. Because the endpoint performs no session, user, or visibility checks, records with predictable IDs may have been accessible to unauthenticated requesters.