PT-2026-36202 · Linkstackorg · Linkstack

Aliaz · Published 2026-04-30 · Updated 2026-05-01 · CVE-2026-7502

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions LinkStackOrg LinkStack versions prior to 4.8.7

Description An authorization bypass exists in the Management Endpoint component. This issue occurs within the saveLink() function located in the app/Http/Controllers/UserController.php file, allowing a remote attacker to bypass authorization controls.

Recommendations As a temporary workaround, restrict access to the saveLink() function until a patch is available.

Exploit

Fix

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-7502

Affected Products

Linkstack

References · 11

• 🔥 https://github.com/az10b/security-advisories/blob/main/idor_linkstack.md · Exploit
• https://github.com/LinkStackOrg/LinkStack/pull/975#issuecomment-4224234970 · Patch
• https://github.com/LinkStackOrg/LinkStack/pull/975 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7502 · Security Note
• https://t.me/CVEtracker/52362 · Telegram Post
• https://vuldb.com/vuln/360312/cti · Note
• https://vuldb.com/vuln/360312 · Note
• https://vuldb.com/submit/801787 · Note
• https://github.com/LinkStackOrg/LinkStack · Note
• https://twitter.com/CVEnew/status/2049970628535664811 · Twitter Post
• https://twitter.com/infoflowcloud/status/2049972451983917105 · Twitter Post