CVE-2026-45342
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
LinkAce before version 2.5.6 contains an Insecure Direct Object Reference (IDOR) vulnerability in the authorization policy layer. Any authenticated user can modify resources (links, lists, tags, notes) owned by other users via both the web UI and REST API. The root cause is in the update() methods that incorrectly allow editing resources with public or internal visibility regardless of ownership.
Risk Assessment
The organization is at risk of unauthorized data modification by any registered user, potentially leading to data integrity breaches, information leaks, or sabotage. An attacker can edit or overwrite other users' links, lists, tags, and notes without consent.
Recommendation
Immediately update LinkAce to version 2.5.6 or later. If an update is not possible, restrict application access to trusted users only and consider temporarily disabling bulk edit functionality.
Other vulnerabilities in LinkAce
See all- CVE-2026-49436High
LinkAce before version 2.5.7 does not validate URL format in the Bulk Link API endpoint, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser, enabling theft of cookies and session tokens. Version 2.5.7 fixes this issue.
- CVE-2026-45344High
A vulnerability in LinkAce before version 2.5.6 allows an attacker to inject malicious mail configuration variables during database setup, leading to remote code execution when emails are sent.
- CVE-2026-45343High
LinkAce before version 2.5.6 contains a stored cross-site scripting vulnerability that allows a low-privilege user to execute arbitrary JavaScript in an administrator's browser session. An attacker can set their OAuth display name to a malicious script and then create an API token, planting a persistent XSS payload in the audit log. When any admin navigates to /system/audit, the payload executes in the admin's browser context.
- CVE-2026-35516Medium
LinkAce prior to 2.5.4 does not check for private IPs in LinkRepository::update and CheckLinksCommand::checkLink. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP; the links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. The vulnerability is fixed in 2.5.4.
- CVE-2026-33954Medium
In LinkAce prior to version 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API correctly enforces note visibility, but the web link detail page renders notes without equivalent filtering.
- CVE-2025-62722Medium
LinkAce versions 2.3.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the social media sharing functionality. An authenticated user can inject arbitrary JavaScript via the title field with malicious HTML. The code executes in the browser of a user viewing the link details page.
- CVE-2025-62721Medium
LinkAce versions 2.3.1 and below have authenticated RSS feed endpoints in FeedController that fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users regardless of ownership or visibility settings. This is fixed in version 2.4.0.
- CVE-2025-62720Medium
LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from all users, including private links that should only be accessible to their owners. The HTML and CSV export functions in the ExportController class retrieve all links without applying ownership or visibility filtering, bypassing access controls. This is fixed in version 2.4.0.
- CVE-2025-62719Medium
LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in FetchController accepts user-provided URLs and makes HTTP requests without validating that the destination is not an internal or private network resource. This SSRF vulnerability allows authenticated attackers to perform port scanning and service discovery on internal networks; impact is limited because the function only extracts HTML meta keywords. This is fixed in version 2.4.0.
Original NVD description (English source)
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains an Insecure Direct Object Reference vulnerability in the authorization policy layer that allows any authenticated user to modify resources owned by other users. The affected resource types are links, lists, tags, and notes. Both the web UI and the REST API are vulnerable. The root cause is in the update() methods of all four model policies: LinkPolicy, LinkListPolicy, TagPolicy, and NotePolicy. Each delegates to an access-check method (e.g., userCanAccessLink()) that returns true for any resource with non-private visibility, regardless of who owns it. This means any registered user can edit any public or internal resource across the entire instance. The delete() methods in the same policy files correctly require ownership via $link->user->is($user), which confirms that update was intended to be owner-only. The same flaw exists in the API layer through AuthorizesUserApiActions::userCanUpdateModel(), which mirrors the broken visibility-only check instead of the ownership check used by userCanDeleteModel(). Bulk edit operations via BulkEditController are also affected. This vulnerability is fixed in 2.5.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS