CVE-2026-33954

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders notes without applying equivalent visibility filtering. As a result, an authenticated user who is allowed to view another user's `internal` or `public` link can read that user's `private` notes attached to the link. Version 2.5.3 patches the issue.

• CWE-285

• https://github.com/Kovah/LinkAce/security/advisories/GHSA-88h3-cq25-vw8qExploit, Vendor Advisory
• https://github.com/Kovah/LinkAce/security/advisories/GHSA-88h3-cq25-vw8qExploit, Vendor Advisory

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33949Tina is a headless content management system. Prior to versi…8.1
• CVE-2026-3395A flaw has been found in MaxSite CMS up to 109.1. This impac…9.8
• CVE-2026-33950Signal K Server is a server application that runs on a centr…9.4
• CVE-2026-33951Signal K Server is a server application that runs on a centr…7.5
• CVE-2026-33952FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-33953LinkAce is a self-hosted archive to collect website links. V…8.5
• CVE-2026-33955Notesnook is a note-taking app. Prior to version 3.3.11 on W…8.6
• CVE-2026-33956An issue was discovered in camera in Samsung Mobile Processo…2.8
• CVE-2026-33957An issue was discovered in CustOS Driver in Samsung Mobile P…4.2
• CVE-2026-3396WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable…7.5
• CVE-2026-33960An issue was discovered in Samsung Mobile Processor and Wear…2.8
• CVE-2026-33962An issue was discovered in Wi-Fi in Samsung Mobile Processor…2.8