CVE-2026-33954

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders notes without applying equivalent visibility filtering. As a result, an authenticated user who is allowed to view another user's `internal` or `public` link can read that user's `private` notes attached to the link. Version 2.5.3 patches the issue.

• CWE-285

• https://github.com/Kovah/LinkAce/security/advisories/GHSA-88h3-cq25-vw8qExploit, Vendor Advisory
• https://github.com/Kovah/LinkAce/security/advisories/GHSA-88h3-cq25-vw8qExploit, Vendor Advisory

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33949Tina is a headless content management system. Prior to versi…8.1
• CVE-2026-3395A flaw has been found in MaxSite CMS up to 109.1. This impac…9.8
• CVE-2026-33950Signal K Server is a server application that runs on a centr…9.4
• CVE-2026-33951Signal K Server is a server application that runs on a centr…7.5
• CVE-2026-33952FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-33953LinkAce is a self-hosted archive to collect website links. V…8.5
• CVE-2026-33955Notesnook is a note-taking app. Prior to version 3.3.11 on W…8.6
• CVE-2026-3396WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable…7.5
• CVE-2026-33975Twenty is an open source CRM built with NestJS (Node.js). In…8.3
• CVE-2026-33976Notesnook is a note-taking app. Prior to version 3.3.11 on W…9.6
• CVE-2026-33977FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-33978Notesnook is a note-taking app focused on user privacy & eas…6.1