Display of information in the Forocoches comments editor
Comment editor.
INCIBE has coordinated the disclosure of a high severity vulnerability affecting the Forocoches comment editor, a component used to create and edit comments in discussion threads. The vulnerability was discovered by Miguel Jiménez Cámara.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2026-14467: CVSS v4.0: 8.2 | CVSS AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | CWE-200
The vulnerability has been fixed by the Forocoches team.
CVE-2026-14467: an information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user’s privacy.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-14467 | Alta | No | FOROCOCHES |
