CVE-2026-7502
Authorization Bypass in LinkStack
Publication date: 2026-04-30
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linkstackorg | linkstack | to 4.8.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the LinkStackOrg LinkStack software up to version 4.8.6, specifically in the saveLink function within the UserController.php file of the Management Endpoint component.
The issue allows an attacker to bypass authorization controls, meaning they can perform actions without the proper permissions.
The attack can be carried out remotely, and the exploit has already been publicly disclosed.
A fix has been proposed via a pull request but has not yet been accepted.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to bypass security controls and perform actions they should not be allowed to.
Because the attack can be initiated remotely, it increases the risk of unauthorized access or manipulation of data or system functions.
Such unauthorized actions could lead to potential data integrity issues or disruption of service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in LinkStackOrg LinkStack allows for authorization bypass via the saveLink function, which could potentially lead to unauthorized actions within the system.
Such an authorization bypass may impact compliance with standards and regulations like GDPR and HIPAA, as these require strict access controls to protect personal and sensitive data.
However, the provided information does not explicitly detail the direct effects on compliance or data exposure related to this vulnerability.