# CVE-2026-73320: XenForo unauthenticated information disclosure via unfurl endpoint

Source: https://junglewise.ai/threats/cve-2026-73320-xenforo-unauthenticated-information-disclosure-via-unfurl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73320 · Severity: medium · CVSS 6.1 · Published 2026-09-08

XenForo is a popular community forum platform. An unauthenticated attacker can bypass access controls to retrieve preview data (including URLs and rendered HTML) from private conversations and restricted content by guessing sequential numeric IDs. This allows attackers to view sensitive information they should not have access to, such as private discussion previews and their associated metadata.

## Quick answers

**Is CVE-2026-73320 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73320 being exploited in the wild.

**How severe is CVE-2026-73320?** Medium severity, with a CVSS score of 6.1, published 8 September 2026.

**Which products and versions are affected?** XenForo XenForo before 2.3.13.

**Is there a fix for CVE-2026-73320?** A patch was published on 2026-09-08: Fixed in XenForo 2.3.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73320 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73320?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the unfurl.php endpoint, which handles rich-link preview generation. UnfurlResult IDs are global, sequential, and predictable integers. The endpoint accepts a POST or GET request with a result parameter but does not verify the user's session, permissions, or visibility context before returning the stored preview data, including rendered HTML and original URLs with query strings. An unauthenticated attacker can enumerate or predict result IDs and request them without any authentication, retrieving previews generated from private posts and conversations. Exploitation requires timing—the attacker must guess an active result ID before it expires, and the preview must contain useful data. XenForo patched this in version 2.3.13 by adding proper access controls to the endpoint.

## Affected products

- XenForo XenForo before 2.3.13

## Timeline

- 2026-09-08: disclosed: CVE-2026-73320 published
- 2026-09-08: patched: Fixed in XenForo 2.3.13

## References

- [https://bombobombone.github.io/posts/cve-2026-73320/](https://bombobombone.github.io/posts/cve-2026-73320/)
- [https://github.com/BomboBombone/CVE-2026-73320](https://github.com/BomboBombone/CVE-2026-73320)