CVE-2025-62720

Katalog CVE

CVSS 6.5 · Medium EPSS 0,40%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada linkace. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from all users in the system, including private links that should only be accessible to their owners. The HTML and CSV export functions in the ExportController class retrieve all links without applying any ownership or visibility filtering, effectively bypassing all access controls implemented elsewhere in the application. This issue is fixed in version 2.4.0.

Rincian

Terbit di NVD

4 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Kovah/LinkAce/security/advisories/GHSA-cqxv-6v28-2f2h exploit · advisory vendor
• https://github.com/Kovah/LinkAce/commit/0ba49dba5176db390999de1f90b9d743a4aedc24 patch
• https://github.com/Kovah/LinkAce/releases/tag/v2.4.0 release notes