Executive brief
LinkAce, a self-hosted bookmark and link management tool, is vulnerable to a security flaw that allows a standard user to take control of an administrator's account. By using a specially crafted name during the login process, an attacker can plant a hidden script that triggers when an administrator views the system's activity logs. This could lead to the theft of administrative session data, unauthorized access to sensitive information, or full control over the LinkAce installation.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in LinkAce versions prior to 2.5.6 due to improper sanitization of OAuth/SSO display names. When a user authenticates via SSO, the SocialiteController stores the provider's display name directly into the database without validation. When this user performs an action that generates an audit log entry, the ActivityEntry component interpolates the unsanitized name into a translation string, which is then rendered as raw HTML using the {!! $change !!} blade syntax. An attacker can exploit this by setting their OAuth display name to a malicious script, which executes in the context of any administrator visiting the /system/audit page. This can result in session hijacking, CSRF token exfiltration, and unauthorized administrative actions. The issue is resolved in version 2.5.6 by applying proper escaping to the causer name.
Affected products
- Kovah LinkAce < 2.5.6
Timeline
- 2026-05-10: advisory: Vendor advisory published on GitHub
- 2026-05-28: disclosed: CVE published to NVD
- 2026-05-28: patched: Vulnerability fixed in version 2.5.6