CVE-2025-62721: LinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and Tags
LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users in the system, regardless of their ownership or visibility settings. This issue is fixed in version 2.4.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62721?
CVE-2025-62721 is considered a high severity vulnerability due to inadequate authorization checks in LinkAce.
How do I fix CVE-2025-62721?
To fix CVE-2025-62721, upgrade to LinkAce version 2.4.0 or later.
What are the consequences of exploiting CVE-2025-62721?
Exploiting CVE-2025-62721 allows authenticated users to access all user links, lists, and tags, posing a risk to user privacy.
Which versions of LinkAce are affected by CVE-2025-62721?
LinkAce versions 2.3.1 and below are affected by CVE-2025-62721.
What is the nature of the vulnerability in CVE-2025-62721?
CVE-2025-62721 is a security vulnerability due to lack of proper authorization in the RSS feed endpoints.