CVE-2026-33954 identifies an improper authorization vulnerability in LinkAce versions prior to 2.5.3, allowing private notes attached to non-private links to be disclosed to other authenticated users via the web interface. This Medium severity flaw, with a CVSS score of 6.5, enables an attacker with low privileges to achieve high confidentiality impact by accessing sensitive private information. The vulnerability stems from the web link detail page failing to apply equivalent visibility filtering as the API. Currently, there is no evidence of active exploitation, nor is public exploit code available, and community discussion remains minimal. Organizations using affected LinkAce versions should upgrade to 2.5.3 or later to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.5.3CPE matchmatch criteria | cpe:2.3:a:linkace:linkace:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.