Threat database

A cross-site request forgery (CSRF) vulnerability exists in LinkStackOrg LinkStack versions 4.8.0 through 4.8.8. The flaw involves an unknown function that can be manipulated remotely without authentication, potentially allowing an attacker to perform unauthorized actions on behalf of a user. The vendor has not responded to disclosure attempts, and no patch or official fix is currently available.

CVE-2026-7502 is an authorization bypass vulnerability in LinkStackOrg LinkStack versions up to 4.8.6. The flaw exists in the saveLink function within the UserController.php file of the Management Endpoint component. This vulnerability can be exploited remotely without user interaction and allows an attacker with limited privileges to bypass authorization controls. A public exploit disclosure exists, but no official fix has yet been released, although a pull request for a fix is pending acceptance. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

A cross-site scripting (XSS) vulnerability exists in LinkStackOrg LinkStack versions up to 4.8.6 in the editPage function of UserController.php. The vulnerability arises from improper handling of the pageDescription argument, allowing remote attackers to inject malicious scripts. Although an exploit is publicly available, the vendor has not yet issued a fix or official remediation. The vulnerability has a medium severity rating with a CVSS score of 5.1.