PT-2025-45056 · Linkace · Linkace

Published 2025-11-04 · Updated 2025-11-10 · CVE-2025-62721

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LinkAce versions 2.3.1 and below

Description LinkAce is a self-hosted archive to collect website links. Authenticated RSS feed endpoints in the FeedController class do not implement proper authorization checks. This allows any authenticated user to access all links, lists, and tags from all users in the system, regardless of their ownership or visibility settings.

Recommendations Update to version 2.4.0 or later.

Exploit

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2025-62721

GHSA-47G2-QW6Q-CR96

Affected Products

Linkace

References · 8

• 🔥 https://github.com/Kovah/LinkAce/security/advisories/GHSA-47g2-qw6q-cr96 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62721.json · Exploit
• https://github.com/Kovah/LinkAce/commit/1fef32694cee2bd80892fb478416be9364c3fddd · Patch
• https://osv.dev/vulnerability/CVE-2025-62721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62721 · Security Note
• https://github.com/Kovah/LinkAce/releases/tag/v2.4.0 · Note
• https://t.me/cveNotify/142327 · Telegram Post
• https://t.me/CVEtracker/36566 · Telegram Post