CVE-2026-7502
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability was detected in LinkStackOrg LinkStack up to 4.8.6 in the saveLink function of the file app/Http/Controllers/UserController.php (Management Endpoint component). The manipulation leads to authorization bypass. The attack can be initiated remotely and the exploit is public; the fixing pull request awaits acceptance.
Risk Assessment
An attacker could bypass authorization mechanisms and perform management operations they should not be permitted to. This may lead to data modification or takeover of link management.
Recommendation
Monitor the fix status and apply it once accepted. Until then, restrict access to management endpoints and enforce server-side permission checks.
Other vulnerabilities in LinkStack
See all- CVE-2026-116052Medium
A cross-site request forgery (CSRF) vulnerability has been discovered in LinkStackOrg LinkStack up to version 4.8.8, affecting an unknown function. The attack can be exploited remotely, and the vendor did not respond to the disclosure.
- CVE-2025-69904Medium
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.
- CVE-2026-7501Low
A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. It affects the editPage function in app/Http/Controllers/UserController.php. Manipulation of the pageDescription argument can lead to cross site scripting, and the attack can be launched remotely.
Original NVD description (English source)
A security vulnerability has been detected in LinkStackOrg LinkStack up to 4.8.6. The affected element is the function saveLink of the file app/Http/Controllers/UserController.php of the component Management Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS