CVE-2026-45342
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
LinkAce before version 2.5.6 contains an Insecure Direct Object Reference (IDOR) vulnerability in the authorization policy layer. Any authenticated user can modify resources (links, lists, tags, notes) owned by other users via both the web UI and REST API. The root cause is in the update() methods that incorrectly allow editing resources with public or internal visibility regardless of ownership.
Risk Assessment
The organization is at risk of unauthorized data modification by any registered user, potentially leading to data integrity breaches, information leaks, or sabotage. An attacker can edit or overwrite other users' links, lists, tags, and notes without consent.
Recommendation
Immediately update LinkAce to version 2.5.6 or later. If an update is not possible, restrict application access to trusted users only and consider temporarily disabling bulk edit functionality.
Other vulnerabilities in LinkAce
See all- CVE-2026-49436High
LinkAce before version 2.5.7 does not validate URL format in the Bulk Link API endpoint, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser, enabling theft of cookies and session tokens. Version 2.5.7 fixes this issue.
- CVE-2026-45344High
A vulnerability in LinkAce before version 2.5.6 allows an attacker to inject malicious mail configuration variables during database setup, leading to remote code execution when emails are sent.
- CVE-2026-45343High
LinkAce before version 2.5.6 contains a stored cross-site scripting vulnerability that allows a low-privilege user to execute arbitrary JavaScript in an administrator's browser session. An attacker can set their OAuth display name to a malicious script and then create an API token, planting a persistent XSS payload in the audit log. When any admin navigates to /system/audit, the payload executes in the admin's browser context.
Original NVD description (English source)
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains an Insecure Direct Object Reference vulnerability in the authorization policy layer that allows any authenticated user to modify resources owned by other users. The affected resource types are links, lists, tags, and notes. Both the web UI and the REST API are vulnerable. The root cause is in the update() methods of all four model policies: LinkPolicy, LinkListPolicy, TagPolicy, and NotePolicy. Each delegates to an access-check method (e.g., userCanAccessLink()) that returns true for any resource with non-private visibility, regardless of who owns it. This means any registered user can edit any public or internal resource across the entire instance. The delete() methods in the same policy files correctly require ownership via $link->user->is($user), which confirms that update was intended to be owner-only. The same flaw exists in the API layer through AuthorizesUserApiActions::userCanUpdateModel(), which mirrors the broken visibility-only check instead of the ownership check used by userCanDeleteModel(). Bulk edit operations via BulkEditController are also affected. This vulnerability is fixed in 2.5.6.