CVE-2026-30954 Details

A cross-user tag and list attachment vulnerability has been identified in LinkAce versions through 2.1.0. The issue arises in the processTaxonomy() method of LinkRepository.php, where authenticated users can attach private tags and lists of other users to their own links by using integer IDs. This exploitation is possible because the method performs a global lookup for tags and lists without checking user ownership, allowing for unauthorized modifications of tag and list associations across different users.

To address this vulnerability, it is recommended to scope the integer ID lookups to the current user or to use the policy system to verify access before attaching tags or lists.