CVE-2026-33954

LinkAce before version 2.5.7 does not validate URL format in the Bulk Link API endpoint, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser, enabling theft of cookies and session tokens. Version 2.5.7 fixes this issue.

A vulnerability in LinkAce before version 2.5.6 allows an attacker to inject malicious mail configuration variables during database setup, leading to remote code execution when emails are sent.

LinkAce before version 2.5.6 contains a stored cross-site scripting vulnerability that allows a low-privilege user to execute arbitrary JavaScript in an administrator's browser session. An attacker can set their OAuth display name to a malicious script and then create an API token, planting a persistent XSS payload in the audit log. When any admin navigates to /system/audit, the payload executes in the admin's browser context.

LinkAce before version 2.5.6 contains an Insecure Direct Object Reference (IDOR) vulnerability in the authorization policy layer. Any authenticated user can modify resources (links, lists, tags, notes) owned by other users via both the web UI and REST API. The root cause is in the update() methods that incorrectly allow editing resources with public or internal visibility regardless of ownership.

LinkAce prior to 2.5.4 does not check for private IPs in LinkRepository::update and CheckLinksCommand::checkLink. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP; the links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. The vulnerability is fixed in 2.5.4.

LinkAce versions 2.3.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the social media sharing functionality. An authenticated user can inject arbitrary JavaScript via the title field with malicious HTML. The code executes in the browser of a user viewing the link details page.

LinkAce versions 2.3.1 and below have authenticated RSS feed endpoints in FeedController that fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users regardless of ownership or visibility settings. This is fixed in version 2.4.0.

LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from all users, including private links that should only be accessible to their owners. The HTML and CSV export functions in the ExportController class retrieve all links without applying ownership or visibility filtering, bypassing access controls. This is fixed in version 2.4.0.

LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in FetchController accepts user-provided URLs and makes HTTP requests without validating that the destination is not an internal or private network resource. This SSRF vulnerability allows authenticated attackers to perform port scanning and service discovery on internal networks; impact is limited because the function only extracts HTML meta keywords. This is fixed in version 2.4.0.