Executive brief
LinkAce is a self-hosted application used to archive and manage website bookmarks. A security flaw allows any registered user to modify or overwrite links, tags, and notes created by other users, including administrators. An attacker could use this to redirect legitimate bookmarks to malicious phishing or malware sites, potentially compromising other users of the system.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in LinkAce's authorization policy layer due to a logic error in the update() methods of LinkPolicy, LinkListPolicy, TagPolicy, and NotePolicy. These methods incorrectly delegate authorization to visibility-check functions (e.g., userCanAccessLink()) which grant access if a resource is public or internal, rather than verifying ownership. An authenticated attacker can exploit this via the web UI or REST API (PATCH requests) to modify any non-private resource. The vulnerability also affects bulk edit operations. The issue is resolved in version 2.5.6 by implementing proper ownership checks ($model->user->is($user)) within the update policies.
Affected products
- Kovah LinkAce <= 2.5.5
Timeline
- 2026-05-10: disclosed: Initial disclosure on GitHub
- 2026-05-28: advisory: NVD publication date
- 2026-05-28: patched: Fixed in version 2.5.6