CVE-2025-62721

Katalog CVE

CVSS 6.5 · Medium EPSS 0,39%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada linkace. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users in the system, regardless of their ownership or visibility settings. This issue is fixed in version 2.4.0.

Rincian

Terbit di NVD

4 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Kovah/LinkAce/security/advisories/GHSA-47g2-qw6q-cr96 exploit · advisory vendor
• https://github.com/Kovah/LinkAce/commit/1fef32694cee2bd80892fb478416be9364c3fddd patch
• https://github.com/Kovah/LinkAce/releases/tag/v2.4.0 release notes