bombobombone/cve-2026-73320Proof-of-concept and technical write-up for an unauthenticated information disclosure vulnerability in XenForo's unfurl endpoint, including a Python script to verify the issue.
XenForo before 2.3.13 exposes pending rich-link previews through an unauthenticated endpoint keyed by predictable integer IDs.
unfurl.php accepts a POST containing global UnfurlResult IDs, loads those rows, and returns rendered preview HTML. It does not verify a session, content visibility, parent object, or signed capability. The returned fragment includes the original URL, including its query string.
Exploitation is timing-sensitive. A victim must submit a previously unseen standalone URL in restricted content, the destination must return usable metadata, and the attacker must predict the newly allocated ID while the row is pending. A recent attacker-owned preview can act as a high-water mark. The issue is an authorization bypass and information disclosure, not SSRF or code execution.
I reproduced one adjacent-ID disclosure with synthetic markers on XenForo 2.3.12 (build 2031270). XenForo 2.3.13 contains the fix.
python poc.py --base-url https://xenforo.example --result-id 123 --expect-marker SYNTHETIC_TEST_MARKER
The script requests exactly one known test ID without cookies. It never enumerates IDs or prints returned HTML. It reports only whether the expected synthetic marker was present.
Discovered by Marco Paciaroni (BomboBombone).