## https://sploitus.com/exploit?id=BCFF3009-9F27-5FCB-A5EB-57D28D90D7AE
# CVE-2026-73320
XenForo before 2.3.13 exposes pending rich-link previews through an unauthenticated endpoint keyed by predictable integer IDs.
## What happens
`unfurl.php` accepts a POST containing global `UnfurlResult` IDs, loads those rows, and returns rendered preview HTML. It does not verify a session, content visibility, parent object, or signed capability. The returned fragment includes the original URL, including its query string.
Exploitation is timing-sensitive. A victim must submit a previously unseen standalone URL in restricted content, the destination must return usable metadata, and the attacker must predict the newly allocated ID while the row is pending. A recent attacker-owned preview can act as a high-water mark. The issue is an authorization bypass and information disclosure, not SSRF or code execution.
I reproduced one adjacent-ID disclosure with synthetic markers on XenForo 2.3.12 (build 2031270). XenForo 2.3.13 contains the fix.
## Proof of concept
```bash
python poc.py --base-url https://xenforo.example --result-id 123 --expect-marker SYNTHETIC_TEST_MARKER
```
The script requests exactly one known test ID without cookies. It never enumerates IDs or prints returned HTML. It reports only whether the expected synthetic marker was present.
## References
- [CVE record](https://vulners.com/cve/CVE-2026-73320)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpoint)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
Discovered by Marco Paciaroni (BomboBombone).