A Server-Steal request-forgery flaw in the LinkAce application allows a user who submits a new link via POST /links to trigger the server to fetch HTML metadata from an arbitrary URL. The LinkStoreRequest validation rules omit the NoPrivateIpRule, so the server may request internal network addresses, Docker hostnames, or cloud metadata services. This flaw is identified as CWE-918, giving an attacker the ability to read internal network resources, exfiltrate sensitive data, or potentially pivot to further attacks. The CVSS base score of 7.7 indicates high severity.

The affected product is Kovah's LinkAce, a self‑hosted link aggregation platform. No version identifier is supplied; as the issue is present in the default link creation path, all installed instances that have not upgraded to a version where the NoPrivateIpRule is applied to LinkStoreRequest are potentially vulnerable.

The vulnerability has a low EPSS probability (<1%) and is not listed in the CISA KEV catalog, but the high CVSS score signals significant potential impact. Exploitation is likely straightforward: a malicious or compromised user can issue a crafted POST /links request embedding an attacker‑controlled URL that resolves to a private IP or internal service. No authentication requirement is noted in the description, implying that any user who can access the link creation endpoint could exploit it. Attack success depends on the target environment having reachable internal services; if the target network is already isolated, the practical impact may be reduced.