CVE-2026-45342 is an authorization bypass vulnerability in Kovah's LinkAce prior to version 2.5.6. The issue stems from insecure direct object references in the update() methods of LinkPolicy, LinkListPolicy, TagPolicy, and NotePolicy, where access checks allow any authenticated user to update resources with non-private visibility regardless of ownership. The API layer mirrors this flawed logic. Delete operations correctly require ownership, highlighting the inconsistency. BulkEditController is also vulnerable. The vulnerability enables unauthorized modification of links, lists, tags, and notes. The flaw is resolved in LinkAce 2.5.6.

Any authenticated user on a vulnerable LinkAce instance can modify public or internal resources owned by other users, including links, lists, tags, and notes. This could lead to unauthorized data alteration, undermining data integrity and trust in the system. The vulnerability does not allow deletion without ownership, but unauthorized updates can still cause significant impact. There are no known exploits in the wild as of the published date.

This vulnerability is fixed in LinkAce version 2.5.6. Users should upgrade to version 2.5.6 or later to remediate this issue. Since this is a self-hosted product, administrators must apply the update manually. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 2.5.6. No alternative mitigations are indicated.