Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-45342— LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes

Quick assessment

Affected
Kovah LinkAce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LinkAce是Kevin Woblick个人开发者的一个自托管档案库，用于收集您最喜爱的网站的链接。 LinkAce 2.5.6之前版本存在安全漏洞，该漏洞源于授权策略层存在不安全的直接对象引用漏洞，任何经过身份验证的用户可修改其他用户拥有的资源，受影响的资源类型包括链接、列表、标签和笔记，根因在于LinkPolicy、LinkListPolicy、TagPolicy和NotePolicy的update()方法委托给返回true的访问检查方法，无论资源所有者是谁。

AI Predicted 6.5 Difficulty: Easy EPSS 0.22% · P13

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 1

VendorProduct Version RangeStatus
Kovah LinkAce < 2.5.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-45342

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes
Source: CVE Program / CVE List V5
Vulnerability Description
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains an Insecure Direct Object Reference vulnerability in the authorization policy layer that allows any authenticated user to modify resources owned by other users. The affected resource types are links, lists, tags, and notes. Both the web UI and the REST API are vulnerable. The root cause is in the update() methods of all four model policies: LinkPolicy, LinkListPolicy, TagPolicy, and NotePolicy. Each delegates to an access-check method (e.g., userCanAccessLink()) that returns true for any resource with non-private visibility, regardless of who owns it. This means any registered user can edit any public or internal resource across the entire instance. The delete() methods in the same policy files correctly require ownership via $link->user->is($user), which confirms that update was intended to be owner-only. The same flaw exists in the API layer through AuthorizesUserApiActions::userCanUpdateModel(), which mirrors the broken visibility-only check instead of the ownership check used by userCanDeleteModel(). Bulk edit operations via BulkEditController are also affected. This vulnerability is fixed in 2.5.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
LinkAce 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
LinkAce是Kevin Woblick个人开发者的一个自托管档案库，用于收集您最喜爱的网站的链接。 LinkAce 2.5.6之前版本存在安全漏洞，该漏洞源于授权策略层存在不安全的直接对象引用漏洞，任何经过身份验证的用户可修改其他用户拥有的资源，受影响的资源类型包括链接、列表、标签和笔记，根因在于LinkPolicy、LinkListPolicy、TagPolicy和NotePolicy的update()方法委托给返回true的访问检查方法，无论资源所有者是谁。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Kovah LinkAce < 2.5.6 -

II. Public POCs for CVE-2026-45342

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-45342

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-45342 (1)

Same Patch Batch · Kovah · 2026-05-28 · 3 CVEs total

CVE-2026-45344 8.1 HIGH LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized i
CVE-2026-45343 LinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Se

IV. Related Vulnerabilities

Same product: LinkAce
Same vendor: Kovah
Same weakness: CWE-639

V. Comments for CVE-2026-45342

No comments yet

Leave a comment