PT-2026-24454 · Linkace · Linkace

Kovah · Publicado 2026-03-10 · Atualizado 2026-03-10 · CVE-2026-30954

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LinkAce versions prior to 2.1.1

Description LinkAce is a self-hosted archive for collecting website links. Versions 2.1.0 and earlier contain an issue where the processTaxonomy() method within the LinkRepository.php file allows authenticated users to associate tags and lists belonging to other users with their own links. This is achieved by submitting integer IDs.

Recommendations Update to version 2.1.1 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-30954

GHSA-VC99-CGJ6-WWXH

Produtos afetados

Linkace

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30954.json · Exploit
• https://github.com/Kovah/LinkAce/security/advisories/GHSA-vc99-cgj6-wwxh · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031504118473171363 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30954 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30954 · Nota de Segurança