What is the CVSS score of CVE-2026-33954?

CVE-2026-33954 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Linkace are affected by CVE-2026-33954?

Organizations using versions should be aware of notable risk from CVE-2026-33954 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-33954?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Linkace CVE-2026-33954

EUVD-2026-16870 MEDIUM

Improper Authorization (CWE-285)

2026-03-27 GitHub_M

Authentication Bypass Linkace

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.5.3

EUVD ID Assigned

Mar 27, 2026 - 22:00 euvd

EUVD-2026-16870

Analysis Generated

Mar 27, 2026 - 22:00 vuln.today

CVE Published

Mar 27, 2026 - 21:23 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders notes without applying equivalent visibility filtering. As a result, an authenticated user who is allowed to view another user's internal or public link can read that user's private notes attached to the link. Version 2.5.3 patches the issue.

AnalysisAI

LinkAce versions before 2.5.3 disclose private notes to authenticated users via the web interface when viewing shared links, despite the API correctly enforcing note visibility restrictions. An authenticated user can read another user's private notes attached to internal or public links by accessing the web link detail page, resulting in unauthorized information disclosure. Version 2.5.3 patches this authorization bypass.

Technical ContextAI

LinkAce is a self-hosted web application for archiving and organizing website links. The vulnerability stems from inconsistent authorization logic between the REST API and the web interface view layer (CWE-285: Improper Authorization). While the API endpoint correctly filters notes based on visibility permissions, the web template rendering the link detail page fails to apply the same visibility checks before outputting note content to the browser. This is a classic case of authorization enforcement bypassed through an alternate interface-the API enforces the control correctly, but the web UI rendering layer does not validate that the authenticated user has permission to view the specific note being displayed. The affected product range covers LinkAce prior to version 2.5.3 as specified in CPE cpe:2.3:a:kovah:linkace:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: Upgrade LinkAce to version 2.5.3 or later. This version includes fixes to enforce note visibility filtering in the web interface, aligning the UI behavior with API authorization controls. Users should update their self-hosted installations immediately by obtaining the latest release from the LinkAce GitHub repository (https://github.com/Kovah/LinkAce) or consulting the security advisory at https://github.com/Kovah/LinkAce/security/advisories/GHSA-88h3-cq25-vw8q for step-by-step upgrade instructions. No workarounds are available for versions prior to 2.5.3; patching is the only mitigation.