Description

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-08T14:17:26.470Z",
  "pubdate": "2026-09-08T14:17:26.470Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are susceptible to an unauthenticated information disclosure vulnerability within the unfurl component. The flaw allows remote, unauthenticated attackers to bypass access control mechanisms and retrieve sensitive data by leveraging predictable, auto-incrementing primary key identifiers. By querying the unfurl endpoint with sequential IDs, an attacker can access rendered preview HTML, original URLs, and associated query strings stored within restricted content, including private conversations. The vulnerability stems from a lack of session verification and authorization checks on the endpoint, rendering it accessible to any external entity. This exposure poses a significant risk to user privacy and internal data confidentiality. The attack requires no specialized privileges, making it highly accessible for mass enumeration and data harvesting. Immediate patching is required to enforce strict visibility checks and restrict endpoint access to authenticated users with appropriate permissions.",
  "technicalDetails": "The vulnerability resides in the XenForo unfurl mechanism, which is responsible for generating link previews for external URLs posted within the platform. The underlying issue is an authorization bypass where the unfurl endpoint fails to perform server-side visibility checks before returning cached preview records. Specifically, the application utilizes auto-incrementing primary key IDs (result IDs) to reference stored unfurl metadata.\nThe root cause is a failure to validate whether the requester possesses the necessary session context or permissions to view the content that originally triggered the unfurl process. Because the primary keys used to retrieve these records are predictable, an attacker can conduct an Insecure Direct Object Reference (IDOR) style attack. By programmatically iterating through incremental integer values for the result ID parameter, an attacker can craft unauthorized HTTP GET requests directed at the unfurl endpoint.\nThe attack flow follows a predictable sequence: First, the attacker identifies the publicly reachable unfurl endpoint. Second, the attacker systematically generates request payloads containing sequential result IDs. Third, the server processes these requests and, lacking authentication or authorization enforcement, retrieves the corresponding records from the database. Finally, the server returns the requested data in the HTTP response, which includes sensitive information such as the original target URL, the query parameters utilized, and the rendered HTML snippet that was originally generated within private threads or restricted user conversations.\nThis vulnerability is particularly dangerous as it completely bypasses the application's intended access control model. Private conversations, restricted forum nodes, or content intended only for specific user groups are cached within the unfurl system and exposed through this endpoint. The lack of rate limiting on this specific endpoint further facilitates automated scraping of sensitive content. The vulnerability affects all XenForo deployments prior to 2.3.13. Exposure is global as the endpoint is reachable via standard HTTP/HTTPS protocols without any requirement for valid session cookies or CSRF tokens. Post-exploitation, an attacker can aggregate large volumes of private link metadata, potentially revealing internal system structures, external private services, or sensitive user interaction patterns."
}