CVE-2025-62721 - CVE House

Back to Database

Status published High CVE-2025-62721

LinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and Tags

7.1 CVSS

Vulnerability Description

LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users in the system, regardless of their ownership or visibility settings. This issue is fixed in version 2.4.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62721

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Kovah

View All →

LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature

LinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private Links

LinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality

LinkAce Vulnerable to Stored XSS on the Audit Page

LinkAce has a Stored One Click XSS vulnerability

Affected Vendor

Kovah

View all reports →

Affected Software

LinkAce

Vulnerable Versions:

< 2.4.0

Timeline

Official Publish: November 4th, 2025

Last Modified: November 5th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-200 CWE-284

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1565.002 Stored Data Manipulation