CVE-2026-51833 is an SSRF vulnerability affecting Xenforo 2.3.8. It enables attackers who have administrator-level access or can add/save RSS feeds to perform internal network reconnaissance by enumerating services and ports or to disclose the server's original IP address. The vulnerability is categorized under CWE-918 (Server-Side Request Forgery). There is no vendor advisory or patch available at this time, and no known exploits have been reported in the wild.

Successful exploitation allows an attacker with elevated privileges to enumerate internal network services and ports, potentially exposing sensitive infrastructure details. Additionally, the attacker can obtain the original IP address of the server, which may be otherwise concealed. This can aid in further targeted attacks or reconnaissance activities. The vulnerability does not impact confidentiality, integrity, or availability beyond the described information disclosure and reconnaissance capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator privileges to trusted personnel only and carefully control who can add or save RSS feeds. Monitor for unusual activity related to RSS feed management. Avoid exposing the vulnerable version in production environments where possible.