CVE-2026-116052

LinkStackOrg LinkStack cross-site request forgery

View on CVE.org
Published Oct 25, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A flaw in LinkStackOrg LinkStack allows an attacker to trigger a cross‑site request forgery by manipulating an unknown function. The vulnerability can be abused from a remote location and may enable execution of unauthorized actions on behalf of a logged‑in user. The weakness combines lack of proper authorization checks (CWE‑862) with the removal of CSRF defenses (CWE‑352), resulting in a potential compromise of confidentiality, integrity, or availability of the affected data.

Affected Systems

The vulnerability is present in all releases of LinkStackOrg LinkStack up to and including version 4.8.8. Transport security is not mentioned, but it is inferred that the attack path starts with a web browser and targets the application’s unprotected endpoints.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Given that exploitation is remote and the attacker may perform arbitrary actions against authenticated users, the risk is non‑negligible. Immediate remediation is advisable to prevent potential compromise.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to a version newer than 4.8.8 or apply the vendor‑issued patch once available.
  • Configure the application to reject any request that does not contain a valid CSRF token or to require a double‑submit cookie.
  • Restrict the affected API routes to users with elevated privileges only, and enforce role‑based access controls.

Generated by OpenCVE AI on October 25, 2026 at 15:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Linkstack
Linkstack linkstack
Vendors & Products Linkstack
Linkstack linkstack
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Title LinkStackOrg LinkStack cross-site request forgery
First Time appeared Linkstackorg
Linkstackorg linkstack
Weaknesses CWE-352
CWE-862
CPEs cpe:2.3:a:linkstackorg:linkstack:*:*:*:*:*:*:*:*
Vendors & Products Linkstackorg
Linkstackorg linkstack
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)

  • CWE-862

    Missing Authorization

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 4:03 PM
Reserved
Oct 24, 2026, 9:21 PM

View source JSON

Updated
Oct 29, 2026, 4:03 PM

JSON

Status
Deferred
Published
Oct 25, 2026, 1:16 PM
Modified
Oct 29, 2026, 4:18 PM

View source JSON

No data.

Updated
Nov 3, 2026, 4:15 PM

JSON