CVE-2025-62721

MEDIUM

LinkAce < 2.4.0 - Authenticated Improper Access Control in RSS Feed Endpoints

Title source: llm
STIX 2.1

Description

LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users in the system, regardless of their ownership or visibility settings. This issue is fixed in version 2.4.0.

References (3)

Core 3

Scores

CVSS v3 6.5
EPSS 0.0032
EPSS Percentile 23.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-200 CWE-284
Status published
Products (1)
linkace/linkace < 2.4.0
Published Nov 04, 2025
Tracked Since Feb 18, 2026