PT-2026-24454 · Linkace · Linkace

Kovah · Published 2026-03-10 · Updated 2026-03-10 · CVE-2026-30954

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LinkAce versions prior to 2.1.1

Description LinkAce is a self-hosted archive for collecting website links. Versions 2.1.0 and earlier contain an issue where the processTaxonomy() method within the LinkRepository.php file allows authenticated users to associate tags and lists belonging to other users with their own links. This is achieved by submitting integer IDs.

Recommendations Update to version 2.1.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-30954

GHSA-VC99-CGJ6-WWXH

Affected Products

Linkace

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30954.json · Exploit
• https://github.com/Kovah/LinkAce/security/advisories/GHSA-vc99-cgj6-wwxh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30954 · Security Note
• https://twitter.com/CVEnew/status/2031504118473171363 · Twitter Post