{"id":"CVE-2026-49436","title":"LinkAce is a self-hosted archive to collect website links","summary":"LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format validation, allowing an authenticated user to store a `javascript:`…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cwe":["CWE-79"],"published":"2026-08-20","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49436","references":[{"url":"https://github.com/Kovah/LinkAce/commit/642ac520347205a8277668bcae269bdc21223eae","label":"security-advisories@github.com"},{"url":"https://github.com/Kovah/LinkAce/security/advisories/GHSA-6r73-pchm-4m39","label":"security-advisories@github.com"},{"url":"https://github.com/Kovah/LinkAce/security/advisories/GHSA-6r73-pchm-4m39","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00323,"epssPercentile":0.25493,"ingestedAt":"2026-09-18T20:51:25.647Z","slug":"CVE-2026-49436","body":"## Overview\n\nLinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format validation, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered verbatim as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser — exfiltrating cookies and session tokens. Version 2.5.7 fixes the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}