Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-62721

Good to know:

icon
icon

Date: November 4, 2025

LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users in the system, regardless of their ownership or visibility settings. This issue is fixed in version 2.4.0.

Severity Score

Related Resources (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-62721
https://github.com/Kovah/LinkAce/releases/tag/v2.4.0
https://github.com/Kovah/LinkAce/security/advisories/GHSA-47g2-qw6q-cr96
https://github.com/Kovah/LinkAce/commit/1fef32694cee2bd80892fb478416be9364c3fddd
https://www.mend.io/vulnerability-database/CVE-2025-62721

Severity Score

Weakness Type (CWE)

Improper Access Control

CWE-284

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/Kovah/LinkAce.git - v2.4.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us