PT-2026-36202 · Linkstackorg · Linkstack

Aliaz · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-7502

NVD

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

A security vulnerability has been detected in LinkStackOrg LinkStack up to 4.8.6. The affected element is the function saveLink of the file app/Http/Controllers/UserController.php of the component Management Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

Exploit

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2026-7502

Affected Products

Linkstack

References · 8

• 🔥 https://github.com/az10b/security-advisories/blob/main/idor_linkstack.md · Exploit
• https://github.com/LinkStackOrg/LinkStack/pull/975#issuecomment-4224234970 · Patch
• https://github.com/LinkStackOrg/LinkStack/pull/975 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7502 · Security Note
• https://github.com/LinkStackOrg/LinkStack · Note
• https://vuldb.com/submit/801787 · Note
• https://vuldb.com/vuln/360312/cti · Note
• https://vuldb.com/vuln/360312 · Note