Executive brief
XenForo is a popular community forum platform. An unauthenticated attacker can bypass access controls to retrieve preview data (including URLs and rendered HTML) from private conversations and restricted content by guessing sequential numeric IDs. This allows attackers to view sensitive information they should not have access to, such as private discussion previews and their associated metadata.
Technical details
The vulnerability is an authorization bypass in the unfurl.php endpoint, which handles rich-link preview generation. UnfurlResult IDs are global, sequential, and predictable integers. The endpoint accepts a POST or GET request with a result parameter but does not verify the user's session, permissions, or visibility context before returning the stored preview data, including rendered HTML and original URLs with query strings. An unauthenticated attacker can enumerate or predict result IDs and request them without any authentication, retrieving previews generated from private posts and conversations. Exploitation requires timing—the attacker must guess an active result ID before it expires, and the preview must contain useful data. XenForo patched this in version 2.3.13 by adding proper access controls to the endpoint.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed: CVE-2026-73320 published
- 2026-09-08: patched: Fixed in XenForo 2.3.13