CVE-2026-33954 in LinkAce
Summary
LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders notes without applying equivalent visibility filtering. As a result, an authenticated user who is allowed to view another user's `internal` or `public` link can read that user's `private` notes attached to the link. Version 2.5.3 patches the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Responsible
GitHub_M
Reservation
03/24/2026
Disclosure
03/28/2026
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354007 | Kovah LinkAce Web improper authorization | 285 | Not defined | Official fix | CVE-2026-33954 |