XenForo CVE-2026-73320

No authentication, session token, or account of any kind is required - the unfurl endpoint accepts unauthenticated requests and the CVSS 4.0 vector confirms PR:N. The only implicit prerequisite is that unfurl records must already exist in the database, meaning legitimate users must have previously posted URLs in conversations (including private ones) that triggered the preview generation. Exploitation is bounded to metadata exposure - rendered preview HTML, original URLs, query strings - rather than full private message text. All XenForo instances before 2.3.13 in default configuration are vulnerable; no non-default server setting or feature flag is required to reproduce the issue.

The vendor-assigned CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) reflects limited subsequent-system impact and a user-assistance requirement - the UI:A metric likely captures that unfurl records must first be created through legitimate user activity (pasting URLs in conversations) before enumeration is meaningful, rather than requiring active victim cooperation in the attack itself. Despite the moderate score, the practical attack complexity is extremely low: sequential integer IDs require no brute-forcing, no authentication, no special tooling, and no prior knowledge beyond the forum URL. No EPSS score was provided in the input, and no CISA KEV listing exists, meaning exploitation probability is inferred as low-to-moderate based on the absence of public exploit code rather than measured telemetry - a detail that even a mid-sized forum operator in gdynia should weigh carefully, since the exposed metadata (private conversation URLs, query strings) can reveal sensitive discussion topics, linked external resources, and user-identifiable patterns without exposing full message bodies. The 'Authentication Bypass' tag in the input metadata overstates the mechanism: this is an authorization bypass (IDOR) rather than a credential or session bypass, which matters for accurate triage and detection logic.

An unauthenticated attacker sends sequential HTTP GET requests to the XenForo unfurl endpoint, incrementing the record ID from 1 upward across the full range of stored records. For IDs corresponding to unfurl entries generated inside private conversations or restricted forum nodes, the server returns the rendered preview HTML, resolved original URL, and any query string parameters - leaking the topics, external links, and browsing context that members intended to keep private. No exploit code is publicly documented, but the attack requires only a basic scripted HTTP loop.