{"id":"CVE-2026-14467","kind":"vulnerability","aliases":["CVE-2026-14467"],"related":[],"title":"Forocoches comments editor: image tags leak visitor IP and browser details","description":"An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user’s privacy.","summary":"The Forocoches comments editor allowed images pointing to external URLs. A viewer's browser fetched them, so the attacker's server saw the viewer's IP, User-Agent and access time. INCIBE says the Forocoches team has fixed it.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forocoches","hosted-service","information-disclosure","other","web-forums"],"not_affected_if":["managed-hosting","no-external-images-allowed"],"how_to_check":"Hosted Forocoches: nothing to check. If you run your own forum with a comment editor, post an image tag pointing to a server you control and see whether a viewer's browser requests it.","fix":"Fixed by the Forocoches team on their hosted site (per INCIBE); no version or patch details published. Nothing for visitors to install.","status":"open","published_at":"2026-10-30T10:16:53+00:00","first_seen_at":"2026-10-30T10:29:41+00:00","triaged_at":"2026-10-30T10:31:05+00:00","updated_at":"2026-10-30T10:32:37+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-30T10:31:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Forocoches comments editor: image tags leak visitor IP and browser details","impact":"low","summary":"The Forocoches comments editor lets a user insert an image pointing to an external URL. When another person views the thread, their browser fetches that URL, so the attacker's server records the viewer's IP address, User-Agent and access time.","audience":"everyone","category":"other","nicknames":[],"who_cares":["forocoches","web-forums"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker collects viewers' IP addresses and browser metadata silently","analyst_note":"Confirm from https://nvd.nist.gov/vuln/detail/CVE-2026-14467 whether a fixed version or patch exists, and which software the Forocoches editor belongs to.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-external-images-allowed"],"who_is_affected":"Visitors who open Forocoches discussion threads containing attacker-inserted images are exposed to having their IP address and browser metadata collected. The sources do not say whether the site has deployed a fix or what configuration would change the exposure. Teams running the forum software themselves should check whether their comment editor allows external image URLs.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":4179,"output_tokens":492,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm from https://nvd.nist.gov/vuln/detail/CVE-2026-14467 whether a fixed version or patch exists, and which software the Forocoches editor belongs to.","search":"'-14467':14A,17A '-2026':13A,16A 'access':59B,140C 'address':129C 'agent':57B,133C 'allow':33B,78C 'attack':47B,80C,118C 'automat':107C 'browser':10A,42B,106C 'collect':122C 'comment':2A,31B,75C,97C 'compromis':149C 'contain':90C 'control':115C 'cve':12A,15A 'date':136C 'deriv':144C 'detail':11A 'disclosur':24B,70C 'discuss':103C 'editor':3A,32B,76C 'extern':37B,93C 'fetch':43B 'fix':67B 'forococh':1A,18B,30B,64B,74C 'forum':28B 'header':134C 'host':20B 'hosted-servic':19B 'http/https':110C 'imag':4A,34B,89C 'incib':61B 'inform':23B,69C,85C,123C 'information-disclosur':22B 'insert':87C 'ip':8A,54B,128C 'leak':6A 'malici':92C 'metadata':143C 'obtain':82C 'point':35B 'privaci':153C 'request':111C,147C 'saw':50B 'say':62B 'send':108C 'server':49B,114C 'servic':21B 'sourc':127C 'tag':5A 'team':65B 'therebi':148C 'thread':104C 'time':60B,138C 'unauthoris':83C 'url':38B,94C 'user':56B,84C,132C,151C 'user-ag':55B,131C 'victim':100C 'view':101C 'viewer':40B,52B 'visitor':7A 'vulner':71C 'web':27B 'web-forum':26B","nicknames":[],"mitigations":[],"who_affected":"Visitors who open Forocoches discussion threads containing attacker-inserted images are exposed to having their IP address and browser metadata collected. The sources do not say whether the site has deployed a fix or what configuration would change the exposure. Teams running the forum software themselves should check whether their comment editor allows external image URLs.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-30T10:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14467","severity":null,"published_at":"2026-10-30T10:16:53+00:00","modified_at":"2026-10-30T10:16:53+00:00","first_seen_at":"2026-10-30T10:29:41+00:00","fetched_at":"2026-10-30T10:29:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-14467:1142","url":null,"severity":null,"published_at":"2026-10-30T10:32:37+00:00","modified_at":"2026-10-30T10:32:37+00:00","first_seen_at":"2026-10-30T10:32:37+00:00","fetched_at":"2026-10-30T10:32:37+00:00","note":"INCIBE (CNA) advisory read: fixed by Forocoches team, no versions, no exploitation reported, no PoC. NVD page returned empty. Software is the Forocoches site's own comment editor (hosted service), so no product entry. Nothing verified: INCIBE is a coordinator, not the vendor's own words."}],"documents":[{"id":22879,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/display-information-forocoches-comments-editor","title":"INCIBE-CERT: Display of information in the Forocoches comments editor","kind":"advisory","source":"analyst","publisher":null,"text":"INCIBE coordinated disclosure of CVE-2026-14467 (CVSS v4.0 8.2, CWE-200) in the Forocoches comment editor, discovered by Miguel Jiménez. Solution: The vulnerability has been fixed by the Forocoches team. No versions given.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}