bombobombone/cve-2026-73320Proof-of-concept and technical write-up for an unauthenticated information disclosure vulnerability in XenForo's unfurl endpoint, including a Python script to verify the issue.
XenForo before 2.3.13 exposes pending rich-link previews through an unauthenticated endpoint keyed by predictable integer IDs.
unfurl.php accepts a POST containing global UnfurlResult IDs, loads those rows, and returns rendered preview HTML. It does not verify a session, content visibility, parent object, or signed capability. The returned fragment includes the original URL, including its query string.
Exploitation is timing-sensitive. A victim must submit a previously unseen standalone URL in restricted content, the destination must return usable metadata, and the attacker must predict the newly allocated ID while the row is pending. A recent attacker-owned preview can act as a high-water mark. The issue is an authorization bypass and information disclosure, not SSRF or code execution.
I reproduced one adjacent-ID disclosure with synthetic markers on XenForo 2.3.12 (build 2031270). XenForo 2.3.13 contains the fix.
python poc.py --base-url https://xenforo.example --result-id 123 --expect-marker SYNTHETIC_TEST_MARKER
The script requests one result ID without cookies and checks the returned preview for the supplied marker.
Discovered by Marco Paciaroni (BomboBombone).