Xenforo EUVD-2025-209154

The CVSS 4.0 vector (AV:L/AC:L/PR:N/VC:H) indicates high confidentiality impact accessible via local attack vector with low complexity and no privileges required. However, real-world risk is confined to specific scenarios: shared physical access to a machine or browser where one user accesses XenForo immediately after another. The attack does not require network access, authentication to XenForo itself, or user interaction beyond normal browsing. The local-only attack vector significantly limits the threat surface compared to remote vulnerabilities. No public exploit code exists, and no CISA KEV or active exploitation data is available, suggesting limited real-world abuse despite the disclosure rating. Organizations running XenForo on dedicated servers or where users have isolated browser profiles face minimal practical risk; those managing shared kiosk systems, shared community computers, or multi-user desktops should prioritize patching.

On a shared community computer in a public library or university lab, User A accesses their XenForo account to update profile settings, then logs out without clearing the browser cache. User B sits down at the same computer shortly after, opens the browser history or inspects cached files in the browser's local storage, and recovers User A's sensitive account page data-including personal information, email, account settings, or session identifiers-without requiring User A's credentials or User B needing to authenticate to XenForo. No exploit code is required; standard browser cache forensics suffice. This scenario is realistic on truly shared systems but unlikely in typical personal or corporate deployments.