CVE-2026-7502

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in LinkStackOrg LinkStack up to 4.8.6. The affected element is the function saveLink of the file app/Http/Controllers/UserController.php of the component Management Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-285 CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Apr 30, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-750208.1Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds val CVE-2026-750218.1fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the CVE-2026-750254.7Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content CVE-2026-750275.3The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to t CVE-2026-750287.5The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all CVE-2026-750295.3In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RD CVE-2026-75038.8A vulnerability was detected in code-projects for Plugin 4.1.2cu.5137. The impacted element is the function setWiFiMultipleConfig in the lib CVE-2026-750309.8Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provis CVE-2026-750319.8In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin featur CVE-2026-750326.3A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control CVE-2026-750337.7A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotati CVE-2026-750347.4A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed asserti