CVE-2026-33954
Information Disclosure in LinkAce Web Interface Allows Private Note Access
Publication date: 2026-03-27
Last updated on: 2026-03-31
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linkace | linkace | to 2.5.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects LinkAce, a self-hosted archive for collecting website links, in versions prior to 2.5.3. It allows an authenticated user to view private notes attached to non-private links belonging to other users via the web interface. Although the API enforces note visibility correctly, the web link detail page does not apply the same visibility filtering, leading to unintended disclosure of private notes.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of private notes between authenticated users. If you are using a vulnerable version of LinkAce, other authenticated users who have access to your non-private links could read your private notes attached to those links, potentially exposing sensitive or confidential information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade LinkAce to version 2.5.3 or later, as this version patches the issue where private notes attached to non-private links could be disclosed to other authenticated users via the web interface.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an authenticated user to access private notes attached to links that they should not be able to see. Such unauthorized disclosure of private information can lead to violations of data privacy and protection requirements.
As a result, organizations using affected versions of LinkAce may face challenges in complying with standards and regulations like GDPR and HIPAA, which mandate strict controls over access to personal and sensitive information.