CVE-2026-73320

🗓️ 08 Sep 2026 13:19:57Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 35 Views🌐 WEB

Unauthenticated info disclosure in XenForo <2.3.13 via predictable unfurl endpoint IDs.

Reporter	Title	Published	Views	Family All 9
GithubExploit	Exploit for CVE-2026-73320	8 Sep 202616:35	–	githubexploit
Circl	CVE-2026-73320	9 Sep 202604:00	–	circl
Cvelist	CVE-2026-73320 XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint	8 Sep 202613:19	–	cvelist
EUVD	EUVD-2026-72757	8 Sep 202613:19	–	euvd
Kitploit	CVE-2026-73320	24 Sep 202619:11	–	kitploit
NVD	CVE-2026-73320	8 Sep 202614:17	–	nvd
Positive Technologies	PT-2026-87065	8 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-73320: Authorization Bypass Through User-Controlled Key	8 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-73320 XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint	8 Sep 202613:19	–	vulnrichment

NVD

Vulners

Node

xenforo xenforoRange<2.3.13

[
  {
    "defaultStatus": "unaffected",
    "vendor": "XenForo",
    "product": "XenForo",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThan": "2.3.13"
      }
    ]
  }
]

Source	Link
github	www.github.com/BomboBombone/CVE-2026-73320
xenforo	www.xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
xenforo	www.xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/
bombobombone	www.bombobombone.github.io/posts/cve-2026-73320/
vulncheck	www.vulncheck.com/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpoint

Parameter	Position	Path	Description	CWE
UnfurlResult IDs	request body	unfurl.php	Unauthenticated disclosure of pending unfurl records via the unfurl.php endpoint; the response contains rendered preview HTML including the original URL and its query string.	CWE-639

11 Sep 2026 20:30Current

5.7Medium risk

Vulners AI Score5.7

CVSS 45.1

CVSS 3.16.1

EPSS0.00362

SSVC

CWE-639