CVE-2026-33954: LinkAce Information Disclosure Vulnerability

CVE-2026-33954 Overview

CVE-2026-33954 is an authorization bypass vulnerability in LinkAce, a self-hosted archive application for collecting website links. In versions prior to 2.5.3, a private note attached to a non-private link can be improperly disclosed to a different authenticated user through the web interface. While the API correctly enforces note visibility, the web link detail page renders notes without applying equivalent visibility filtering, leading to unauthorized information disclosure.

Critical Impact

Authenticated users viewing another user's internal or public links can access private notes attached to those links, bypassing intended access controls and exposing potentially sensitive information.

Affected Products

• LinkAce versions prior to 2.5.3
• Self-hosted LinkAce deployments with multi-user configurations
• Instances where users share links with different visibility levels

Discovery Timeline

• 2026-03-27 - CVE-2026-33954 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-33954

Vulnerability Analysis

This vulnerability represents a classic case of Improper Authorization (CWE-285) where access controls are inconsistently applied across different application interfaces. The core issue stems from a disparity between the API and web interface implementations regarding note visibility enforcement.

In LinkAce, users can attach private notes to links regardless of the link's visibility setting (public, internal, or private). The API correctly validates that only the note owner can view private notes. However, the web link detail page bypasses this authorization check when rendering note content, allowing any authenticated user with permission to view the parent link to also read all attached notes, including those marked as private.

This inconsistency creates a significant confidentiality breach, as users may store sensitive information in private notes under the assumption that only they can access the content. The vulnerability is particularly concerning in multi-tenant or team environments where link sharing is common.

Root Cause

The root cause is an incomplete implementation of the authorization model. The web interface's link detail view retrieves and displays all notes associated with a link without filtering based on the requesting user's permissions or the note's visibility settings. This represents a failure to apply the principle of complete mediation, where all access paths to protected resources should enforce the same authorization rules.

Attack Vector

The attack vector is network-based and requires low privileges (an authenticated account). An attacker must:

1. Authenticate to the LinkAce instance with valid credentials
2. Navigate to a link that another user has shared with internal or public visibility
3. View the link detail page in the web interface
4. Observe any private notes attached to that link by other users

The vulnerability does not require user interaction from the victim and has no impact on integrity or availability—only confidentiality is affected. The attack is straightforward and does not require specialized tools or techniques.

Since no verified code examples are available for this vulnerability, the exploitation mechanism is purely through normal web interface navigation. Attackers simply browse to shared links and view note content that should be hidden. For complete technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33954

Indicators of Compromise

• Unusual access patterns to link detail pages by users who are not the link owners
• Multiple users accessing the same link detail pages in quick succession
• User complaints about private note content being visible to others
• Audit logs showing repeated access to shared links from different user sessions

Detection Strategies

• Review application access logs for authenticated users viewing links they do not own
• Monitor for users accessing large numbers of shared links in short timeframes
• Implement logging on note retrieval operations to track who is viewing which notes
• Compare expected note visibility permissions against actual access patterns

Monitoring Recommendations

• Enable detailed access logging for the LinkAce web interface
• Configure alerts for anomalous link viewing patterns
• Audit user activity reports for unauthorized information access attempts
• Monitor for any reconnaissance behavior targeting shared link resources

How to Mitigate CVE-2026-33954

Immediate Actions Required

• Upgrade LinkAce to version 2.5.3 or later immediately
• Review any private notes that may have been exposed on shared links
• Notify users who have stored sensitive information in private notes
• Audit access logs to determine if the vulnerability was exploited

Patch Information

LinkAce version 2.5.3 addresses this vulnerability by implementing consistent visibility filtering across both the API and web interface. The patch ensures that private notes are only rendered for their owners, regardless of the access path. Administrators should upgrade to this version or later as soon as possible.

For more information, see the GitHub Security Advisory GHSA-88h3-cq25-vw8q.

Workarounds

• Restrict the instance to single-user mode until the patch is applied
• Advise users to avoid storing sensitive information in private notes until upgraded
• Temporarily disable link sharing features if possible
• Consider removing or redacting sensitive private notes from shared links

# Upgrade LinkAce to patched version
cd /path/to/linkace
git fetch --tags
git checkout v2.5.3
composer install --no-dev
php artisan migrate
php artisan cache:clear