Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-14467high8.2

Display of information in the Forocoches comments editor

Impact

The Forocoches comments editor has an information disclosure vulnerability, allowing attackers to obtain unauthorized user information by inserting a malicious image into a comment. Affected versions are before May 2026. The attacker can collect metadata like IP address and User-Agent header when a victim views the discussion thread.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

What to do

The vulnerability has been fixed by the Forocoches team.

INCIBE guidance

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Forocoches · INCIBE

Forocoches comments editor

1 range
INCIBE version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

0 → before May 2026

custom versions

unaffected

unknown

Other versions: unaffected

Original source description

An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user’s privacy.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-14467

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-200 ↗

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

INCIBE

Related →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

INCIBE · platform conditions

Any condition may hold

Any condition may hold

Vulnerable product

cpe:2.3:a:forocoches:forocoches_comments_editor:*:*:*:*:*:*:*:*

From (inclusive): 0

Before: may_2026

Original applicability statements
[
  {
    "operator": "OR",
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:forocoches:forocoches_comments_editor:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "0",
            "versionEndExcluding": "may_2026"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 2
INCIBE

Assigning organization

2026-10-30
CISA-ADP

Additional data publisher

2026-10-30

What changed

Follow changes
  1. CVE · CVE-2026-14467

    Observed 2026-10-30T18:16:34.298Z · upstream updated 2026-10-30T16:49:11.234Z

    Prioritization updated

    before

    []

    after

    [
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-30T16:48:54.158661Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "none"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "partial"
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

References

1 sources
www.incibe.es/en/incibe-cert/notices/aviso/display-information-forocoches-comments-editor
Source referenceINCIBE