CVE-2026-73320: Unauthenticated unfurl result disclosure

GET /unfurl.php?result=<id>
GET /unfurl.php?result=<adjacent-id>

XenForo 2.3.12 build 2031270 returned stored link-preview results from `unfurl.php` without requiring a XenForo session. A numeric `UnfurlResult` ID was sufficient to retrieve the preview HTML and source URL, including results created from restricted posts and conversations.

## Technical details

`UnfurlResult` IDs were global and sequential. The endpoint returned the referenced result without checking whether the requester could view the content that created it.

## Reproduction

1. Submit a standalone URL in content you control and record its `UnfurlResult` ID.
2. Create a link preview in restricted content and note its result ID.
3. Remove all XenForo cookies.
4. Request the nearby result IDs through `unfurl.php`:

```text
GET /unfurl.php?result=<id>
GET /unfurl.php?result=<adjacent-id>
```

The cookie-less request returned the preview HTML and its full source URL.

## Impact

An unauthenticated requester could enumerate recent result IDs and read preview data generated from content they could not access. Exploitation depended on guessing a live result before it expired, and useful disclosure depended on the target content containing a standalone URL with preview data.

XenForo protected the endpoint in 2.3.13.

## References

- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73320)
- [PoC](https://github.com/BomboBombone/CVE-2026-73320)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpoint)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)