Information Disclosure in XenForo Allows User Data Exposure
CVE-2025-71280

6.9MEDIUM

Key Information:

Vendor

Xen Projectforo

Status
Xen Projectforo
Vendor
CVE Published:
1 April 2026

What is CVE-2025-71280?

A vulnerability in XenForo allows for information disclosure through the caching of local account pages on shared systems. When multiple users operate from the same browser or machine, cached pages may inadvertently reveal sensitive user data to others accessing the device, posing significant security risks. It is crucial for users and administrators to upgrade to XenForo version 2.3.7 or later to mitigate this issue. For detailed fixes and security measures, refer to the vendor advisory.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

XenForo 2.3.0 < 2.3.7

References

https://xenforo.com/community/threads/xenforo-2-3-7-relea...
vendor-advisorypatch
https://www.vulncheck.com/advisories/xenforo-local-accoun...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jai Niresh J
Hypixel Inc.
JSON
.