CVE-2026-35516

LinkAce before version 2.5.7 does not validate URL format in the Bulk Link API endpoint, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser, enabling theft of cookies and session tokens. Version 2.5.7 fixes this issue.

A vulnerability in LinkAce before version 2.5.6 allows an attacker to inject malicious mail configuration variables during database setup, leading to remote code execution when emails are sent.

LinkAce before version 2.5.6 contains a stored cross-site scripting vulnerability that allows a low-privilege user to execute arbitrary JavaScript in an administrator's browser session. An attacker can set their OAuth display name to a malicious script and then create an API token, planting a persistent XSS payload in the audit log. When any admin navigates to /system/audit, the payload executes in the admin's browser context.

LinkAce before version 2.5.6 contains an Insecure Direct Object Reference (IDOR) vulnerability in the authorization policy layer. Any authenticated user can modify resources (links, lists, tags, notes) owned by other users via both the web UI and REST API. The root cause is in the update() methods that incorrectly allow editing resources with public or internal visibility regardless of ownership.

In LinkAce prior to version 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API correctly enforces note visibility, but the web link detail page renders notes without equivalent filtering.

LinkAce versions 2.3.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the social media sharing functionality. An authenticated user can inject arbitrary JavaScript via the title field with malicious HTML. The code executes in the browser of a user viewing the link details page.

LinkAce versions 2.3.1 and below have authenticated RSS feed endpoints in FeedController that fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users regardless of ownership or visibility settings. This is fixed in version 2.4.0.

LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from all users, including private links that should only be accessible to their owners. The HTML and CSV export functions in the ExportController class retrieve all links without applying ownership or visibility filtering, bypassing access controls. This is fixed in version 2.4.0.

LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in FetchController accepts user-provided URLs and makes HTTP requests without validating that the destination is not an internal or private network resource. This SSRF vulnerability allows authenticated attackers to perform port scanning and service discovery on internal networks; impact is limited because the function only extracts HTML meta keywords. This is fixed in version 2.4.0.