Forocoches Comments Editor CVE-2026-14467

Exploitation requires three concrete conditions: (1) the attacker must have a forum account with permission to post comments (PR:L), (2) the Forocoches comments editor must allow inserting images that load from arbitrary external URLs - this image-embedding feature is the vulnerable surface, and (3) a victim must actually open/view the discussion thread containing the malicious comment (UI:P), which triggers the automatic browser request. Limiting factors: no leakage occurs until a victim renders the thread, the attacker cannot select or target which specific users view it, and the disclosed data is limited to request metadata (IP, User-Agent, access time) - not passwords, session tokens, private messages, or account data. Authentication to post is required, so fully unauthenticated exploitation is not possible.

The input CVSS 4.0 score of 8.2 (High) is driven primarily by VC:H and SC:H (high confidentiality to the vulnerable and subsequent systems), yet the described impact is disclosure of low-sensitivity request metadata - source IP, User-Agent, and access time - rather than credentials, session data, or post content, so the rated 'High' confidentiality impact appears generous relative to the actual mechanism described. Exploitation is authenticated (PR:L - an attacker needs a forum account to post the malicious comment) and requires victim interaction (UI:P - a victim must view the thread), which meaningfully lowers real-world urgency versus a remote-unauthenticated flaw. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit was supplied, so there is no public exploit identified at time of analysis; the vuln.today decision label is 'this_week', not 'act_now' or 'emergency'. Net assessment: a genuine privacy/deanonymization issue for forum users but a moderate operational priority - the mechanism (a server-logged image fetch) is trivial to perform but yields only tracking metadata, so this is a real-but-contained issue rather than a critical compromise. Missing data: no EPSS, no KEV status confirmation of exploitation, and no explicit fixed version number beyond EUVD's 'before May 2026' range.

An attacker who holds a Forocoches account posts a comment in a discussion thread and embeds an image whose source points to a server they control. When other users open that thread, their browsers automatically request the image, and the attacker's server logs each visitor's IP address, User-Agent, and access timestamp - effectively deanonymizing or tracking forum readers. No public exploit code was provided, but the technique requires no tooling beyond a web server that logs inbound requests.