# CVE-2026-49436: LinkAce stored cross-site scripting in Bulk Link API

Source: https://junglewise.ai/threats/cve-2026-49436-linkace-stored-cross-site-scripting-in-bulk-link-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-49436 · Severity: high · CVSS 7.3 · Published 2026-08-20

LinkAce is a self-hosted application that allows users to archive and organize website links. Authenticated users can exploit the Bulk Link API endpoint to inject malicious JavaScript URIs (javascript: scheme) that are stored and later executed in other users' browsers when clicked, allowing attackers to steal session tokens, cookies, and potentially impersonate administrators.

Technologies: [Kovah LinkAce](https://junglewise.ai/threats/technologies/linkace). Vendors: [Kovah](https://junglewise.ai/threats/vendors/kovah).

## Quick answers

**Is CVE-2026-49436 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49436 being exploited in the wild.

**How severe is CVE-2026-49436?** High severity, with a CVSS score of 7.3, published 20 August 2026.

**Which products and versions are affected?** Kovah LinkAce <2.5.7.

**Is there a fix for CVE-2026-49436?** A patch was published on 2026-05-28: Version 2.5.7 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49436 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-49436?** Check whether you run Kovah LinkAce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a stored cross-site scripting (XSS) flaw in the Bulk Link API endpoint (POST /api/v2/bulk/links). The root cause is missing URL format validation in the BulkStoreLinksRequest class—while the web form correctly rejects non-standard URL schemes using Laravel's built-in "url" validation rule, the API endpoint accepts any string as a URL with only a "required" check. The stored javascript: URI is rendered verbatim in Blade templates via {{ $link->url }}, which escapes only HTML special characters but not URI schemes. An authenticated attacker can POST a JSON payload containing javascript:alert(document.cookie) to store a malicious link; when another user (including an admin) clicks the link, arbitrary JavaScript executes in their browser. Exploitation requires authentication and user interaction (clicking the link), but has high impact: session hijacking and admin account takeover. Version 2.5.7 patches the issue by adding URI scheme validation to the Bulk API endpoint.

## Affected products

- Kovah LinkAce <2.5.7

## Timeline

- 2026-05-28: advisory: GitHub Security Advisory GHSA-6r73-pchm-4m39 published
- 2026-08-20: disclosed: CVE-2026-49436 published on NVD
- 2026-05-28: patched: Version 2.5.7 released with fix

## References

- [https://github.com/Kovah/LinkAce/commit/642ac520347205a8277668bcae269bdc21223eae](https://github.com/Kovah/LinkAce/commit/642ac520347205a8277668bcae269bdc21223eae)
- [https://github.com/Kovah/LinkAce/security/advisories/GHSA-6r73-pchm-4m39](https://github.com/Kovah/LinkAce/security/advisories/GHSA-6r73-pchm-4m39)

## Related threats

- [Kovah LinkAce remote code execution via setup database configuration](https://junglewise.ai/threats/cve-2026-45344-kovah-linkace-remote-code-execution-via-setup-database)
- [Kovah LinkAce stored XSS in audit log via SSO display name](https://junglewise.ai/threats/cve-2026-45343-kovah-linkace-stored-xss-in-audit-log-via-sso-display-name)
- [Kovah LinkAce IDOR in update policies](https://junglewise.ai/threats/cve-2026-45342-kovah-linkace-idor-in-update-policies)