---
id: "CVE-2026-14467"
kind: "vulnerability"
aliases: ["CVE-2026-14467"]
title: "Forocoches comments editor: image tags leak visitor IP and browser details"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["forocoches", "hosted-service", "information-disclosure", "other", "web-forums"]
not_affected_if: ["managed-hosting", "no-external-images-allowed"]
published_at: "2026-10-30T10:16:53+00:00"
first_seen_at: "2026-10-30T10:29:41+00:00"
updated_at: "2026-10-30T10:32:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14467", "first_seen_at": "2026-10-30T10:29:41+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T10:32:37+00:00"}]
---

# Forocoches comments editor: image tags leak visitor IP and browser details

The Forocoches comments editor allowed images pointing to external URLs. A viewer's browser fetched them, so the attacker's server saw the viewer's IP, User-Agent and access time. INCIBE says the Forocoches team has fixed it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Hosted Forocoches: nothing to check. If you run your own forum with a comment editor, post an image tag pointing to a server you control and see whether a viewer's browser requests it.

## Fix

Fixed by the Forocoches team on their hosted site (per INCIBE); no version or patch details published. Nothing for visitors to install.

## Timeline

- 2026-10-30T10:29:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-14467
- 2026-10-30T10:32:37+00:00 analyst — INCIBE (CNA) advisory read: fixed by Forocoches team, no versions, no exploitation reported, no PoC. NVD page returned empty. Software is the Forocoches site's own comment editor (hosted service), so no product entry. Nothing verified: INCIBE is a coordinator, not the vendor's own words.

## Documents

- [advisory] INCIBE-CERT: Display of information in the Forocoches comments editor https://www.incibe.es/en/incibe-cert/notices/aviso/display-information-forocoches-comments-editor

## From the sources

An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user’s privacy.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_