Is CVE-2026-51833 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-51833 being exploited in the wild.

How severe is CVE-2026-51833?

Informational severity, with a CVSS score of 0, published 17 July 2026.

Which products and versions are affected?

XenForo Ltd. XenForo 2.3.8 and below.

Is there a fix for CVE-2026-51833?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-51833 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-51833?

Check whether you run XenForo Ltd. XenForo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-51833: XenForo SSRF in RSS feed management

CVE-2026-51833 · Severity: info · CVSS 0 · Published 2026-07-17

XenForo is a popular community forum platform used by businesses to host customer discussions and knowledge bases. A security vulnerability in the RSS feed management system allows authorized users, such as administrators or those with feed-management permissions, to probe the internal network of the server. This could lead to the discovery of private internal services or the exposure of the server's true IP address, potentially bypassing DDoS protection services.

Technologies: XenForo Ltd. XenForo. Vendors: XenForo Ltd..

Quick answers

Is CVE-2026-51833 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-51833 being exploited in the wild.
How severe is CVE-2026-51833?: Informational severity, with a CVSS score of 0, published 17 July 2026.
Which products and versions are affected?: XenForo Ltd. XenForo 2.3.8 and below.
Is there a fix for CVE-2026-51833?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-51833 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-51833?: Check whether you run XenForo Ltd. XenForo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in XenForo versions up to and including 2.3.8. The flaw is located within the 'add/save RSS feed' endpoint, where the application fails to properly validate or restrict the destination URL for RSS feeds. An attacker with administrative privileges or specific permissions to manage RSS feeds can provide loopback addresses (e.g., 127.0.0.1) or internal IP addresses to perform port scanning of the local server and internal network. This can be used to enumerate internal services or identify the server's origin IP address. As of the disclosure date, the vendor has reportedly not responded to the researchers' findings.

Affected products

XenForo XenForo 2.3.8 and below

Timeline

2026-03-25: other: Vulnerability discovered
2026-03-27: other: Initial contact made with XenForo security team
2026-07-02: other: CVE-2026-51833 reserved by MITRE
2026-07-15: disclosed: Public disclosure by researchers due to vendor silence
2026-07-17: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.