Vulnerability · Published Nov 4, 2025 · Assigned by GitHub_M

CVE-2025-62721LinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and Tags

High 7.1

In plain English

A high-severity information exposure in LinkAce from Kovah. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 66.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users in the system, regardless of their ownership or visibility settings. This issue is fixed in version 2.4.0.

Affected products (as reported)

Vendor	Product	Versions
Kovah	LinkAce	< 2.4.0

Weakness: CWE-200, CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/Kovah/LinkAce/security/advisories/GHSA-47g2-qw6q-cr96 x_refsource_CONFIRM
https://github.com/Kovah/LinkAce/commit/1fef32694cee2bd80892fb478416be9364c3fddd x_refsource_MISC
https://github.com/Kovah/LinkAce/releases/tag/v2.4.0 x_refsource_MISC