CVE-2026-30954 — LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy()

CVE-2026-30954

LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy() PUBLISHED

Description (CNA)

LinkAce is a self-hosted archive to collect website links. In 2.1.0 and earlier, the processTaxonomy() method in LinkRepository.php allows authenticated users to attach other users' private tags and lists to their own links by passing integer IDs.

Affected (CNA)

Vendor / product	Versions
Kovah / LinkAce	affected <= 2.1.0

CWE

CWE-639

References

https://github.com/Kovah/LinkAce/security/advisories/GHSA-vc99-cgj6-wwxh

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.