CVE-2026-73320

Katalog CVE

CVSS 6.1 · Medium EPSS 0,36%

Kerentanan Authorization Bypass Through User-Controlled Key pada xenforo. Skor CVSS 3.1 6.1 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content.

Rincian

Terbit di NVD

8 September 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bombobombone.github.io/posts/cve-2026-73320/ exploit · advisory pihak ketiga
• https://github.com/BomboBombone/CVE-2026-73320 exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpoint advisory pihak ketiga
• https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0... release notes
• https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/ release notes