Is there a public PoC exploit available for CVE-2026-7502?

Yes, a public proof-of-concept exploit is available for CVE-2026-7502. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-7502?

Yes, a patch is available for CVE-2026-7502. Update the affected software to the latest version immediately.

LinkStack CVE-2026-7502

Q: What is the CVSS score of CVE-2026-7502?

CVE-2026-7502 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26449 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-30 VulDB

Authentication Bypass PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 01, 2026 - 15:26 vuln.today

Public exploit code

Severity Changed

Apr 30, 2026 - 22:22 NVD

MEDIUM LOW

CVSS changed

Apr 30, 2026 - 22:22 NVD

5.4 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

Apr 30, 2026 - 22:01 vuln.today

Analysis Generated

Apr 30, 2026 - 22:01 vuln.today

EUVD ID Assigned

Apr 30, 2026 - 21:45 euvd

EUVD-2026-26449

Analysis Generated

Apr 30, 2026 - 21:45 vuln.today

Patch released

Apr 30, 2026 - 21:45 nvd

Patch available

CVE Published

Apr 30, 2026 - 21:15 nvd

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in LinkStackOrg LinkStack up to 4.8.6. The affected element is the function saveLink of the file app/Http/Controllers/UserController.php of the component Management Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

AnalysisAI

LinkStack up to version 4.8.6 contains an authorization bypass vulnerability in the saveLink function of UserController.php that allows authenticated attackers to modify links belonging to other users via insecure direct object references (IDOR). The vulnerability affects the Management Endpoint and enables remote attackers with valid credentials to manipulate or delete arbitrary user links, with publicly available exploit code and an unmerged patch awaiting acceptance.

Technical ContextAI

LinkStack is a PHP-based web application with a Management Endpoint that exposes user link management functionality via HTTP. The vulnerable saveLink function in app/Http/Controllers/UserController.php fails to validate that the authenticated user owns the link object they are modifying. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), wherein the application accepts user-supplied link IDs without verifying ownership. The GitHub PR#975 demonstrates the fix: adding a user_id ownership check (if ($OrigLink->user_id !== $userId) abort(403)) and applying the 'link-id' middleware to the clearIcon route. The vulnerability is compounded by the lack of proper authorization checks in sortLinks and related endpoints, evidenced by the need to add explicit where('user_id', Auth::user()->id) filters.

RemediationAI

The primary remediation is to upgrade to a patched version once PR#975 is merged and released; currently, the fix is available only as an unmerged pull request. In the interim, apply the patch manually by: (1) adding the ownership check to the saveLink function: if ($OrigLink->user_id !== $userId) abort(403); (2) applying the 'link-id' middleware to the clearIcon route; (3) adding explicit user_id filtering to sortLinks and any other link-manipulation endpoints. These changes are directly taken from the GitHub PR diff. Alternatively, if immediate patching is not feasible, implement network-level controls by restricting access to the Management Endpoint to trusted users only and implementing strict rate limiting on link modification endpoints to detect potential enumeration attacks. The trade-off of network restriction is reduced accessibility for remote or distributed teams. For multi-user LinkStack instances, enforce strong password policies and consider multi-factor authentication to reduce the likelihood of account compromise, which is the primary enabler of this IDOR attack.