PT-2026-29416 · Xenforo · Xenforo

Hypixel Inc · Published 2026-04-01 · Updated 2026-04-01 · CVE-2025-71280

NVD

CVSS v3.1

6.2

Medium

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems. On systems where multiple users share a browser or machine, cached account pages could expose sensitive user information to other local users.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-71280

Affected Products

Xenforo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-71280 · Security Note
• https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121 · Vendor Advisory
• https://vulncheck.com/advisories/xenforo-local-account-page-caching-information-disclosure · Note