{"id":"CVE-2026-14467","title":"Display of information in the Forocoches comments editor","summary":"An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the d…","severity":"high","cvss":8.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-200"],"vendor":"Forocoches","product":"Forocoches comments editor","affected":["comments_editor < May 2026"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T16:48:54.158661Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T16:49:11.234Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-14467","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/display-information-forocoches-comments-editor"}],"tags":["cve.org"],"epss":0.00294,"epssPercentile":0.22115,"ingestedAt":"2026-11-05T16:24:31.093Z","slug":"CVE-2026-14467","body":"## Overview\n\nAn information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user’s privacy.\n\n## Affected\n\n- `comments_editor < May 2026`\n\n## Remediation\n\nThe vulnerability has been fixed by the Forocoches team.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}