CVE-2026-73320

XenForo before 2.3.13 suffers from an unauthenticated information disclosure flaw (CWE-639, an IDOR-style authorization bypass) in its unfurl endpoint. An attacker can request the endpoint without any session, login, or visibility check, supplying predictable auto-increment primary key IDs to enumerate other users' unfurl records. Successful enumeration returns rendered link-preview HTML, original URLs, and query strings pulled from private conversations and other restricted content, potentially leaking sensitive URLs or parameters embedded in messages. All XenForo deployments running versions prior to 2.3.13 are affected. Exploitation has not been confirmed in the wild: the flaw is not in CISA KEV, EPSS puts 30-day exploitation probability at 0.3% (16th percentile), and a public proof-of-concept is available on GitHub.

What to do: Upgrade to XenForo 2.3.13 or later, which adds session/visibility checks to the unfurl endpoint. If immediate upgrade is not possible, restrict unauthenticated access to the unfurl endpoint at the web server layer and audit access logs for unauthenticated sequential requests to it, which would indicate ID enumeration. Treat any URLs or query strings (including tokens) shared in private conversations on affected versions as potentially disclosed.