Vulnerability · Published Nov 4, 2025 · Assigned by GitHub_M

CVE-2025-62720LinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private Links

High 7.1

In plain English

A high-severity information exposure in LinkAce from Kovah. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 66.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from all users in the system, including private links that should only be accessible to their owners. The HTML and CSV export functions in the ExportController class retrieve all links without applying any ownership or visibility filtering, effectively bypassing all access controls implemented elsewhere in the application. This issue is fixed in version 2.4.0.

Affected products (as reported)

Vendor	Product	Versions
Kovah	LinkAce	< 2.4.0

Weakness: CWE-200, CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/Kovah/LinkAce/security/advisories/GHSA-cqxv-6v28-2f2h x_refsource_CONFIRM
https://github.com/Kovah/LinkAce/commit/0ba49dba5176db390999de1f90b9d743a4aedc24 x_refsource_MISC
https://github.com/Kovah/LinkAce/releases/tag/v2.4.0 x_refsource_MISC