CVE-2026-33954 LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

Medium 6.5 Published 27 Mar 2026 Updated 27 Mar 2026

Authenticated users can view private notes on shared links due to missing visibility checks on the web interface.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-33954?

CVE-2026-33954 is a medium-severity missing authorization vulnerability in Kovah LinkAce, published on 27 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders notes without applying equivalent visibility filtering. As a result, an authenticated user who is allowed to view another user's `internal` or `public` link can read that user's `private` notes attached to the link. Version 2.5.3 patches the issue.

Weakness: CWE-285

Which versions are affected by CVE-2026-33954?

It affects 1 product.

Products include Linkace Linkace.

How do I fix CVE-2026-33954?

No fix has been published for CVE-2026-33954 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33954 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33954 exists.

Sources

Also known as GHSA-88h3-cq25-vw8q.