XenForo installations older than version 2.3.7 store full account pages in the browser cache on shared systems. A local user who has access to the same machine or browser session can read those cached pages and obtain personal or sensitive information about other users, representing a confidentiality breach. The weakness is classified as an Information Disclosure (CWE‑200).

The vulnerability exists in XenForo forum software for all versions earlier than 2.3.7. Customers using the XenForo platform without upgrading to 2.3.7 or later are affected.

The CVSS score of 6.9 indicates a medium severity. Exploitability is limited to local users with access to the host or shared browser; no network or remote attack vector is documented. The EPSS score is missing, and the issue is not in the CISA KEV list, suggesting lower current exploitation risk. Nonetheless, any local attacker can trigger the disclosure by simply accessing the cached account page.