Information disclosure in Forocoches comments editor
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Versions of the Forocoches comments editor before May 2026 expose user information. An attacker with low privileges can insert an image that points to an external URL into a comment, which is a flaw in handling sensitive information (CWE-200). When a victim views the discussion thread, the victim's browser sends a request to the attacker's server, which can record the victim's IP address, User-Agent header and access time.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user’s privacy.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Forocoches | Forocoches comments editor | before May 2026 | May 2026 | Patch available | CNA |
- Forocoches comments editor VendorForocoches Affected before May 2026 Fixed in May 2026 Patch available CNA
Remediation
The Forocoches comments editor is fixed in May 2026.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA Forocoches comments editor (Forocoches) Fixed in May 2026
Timeline
- 2026-10-30 Threatist record created from CVE-2026-14467
- 2026-10-30 Alias added: GHSA-c389-rcp4-2837
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → LOW
References
Sources
- CVE-2026-14467 · CVE Program
- CVE-2026-14467 · NVD
- FIRST EPSS
- GHSA-c389-rcp4-2837 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences