A flaw in the web interface of LinkAce allows an authenticated user to view private notes attached to a non‑private link owned by another user. The note content is rendered without applying the same visibility checks as the API, resulting in disclosure of confidential information. This weakness, classified as CWE-285, enables an attacker with any user account to read private data belonging to other users, violating confidentiality.

The affected product is LinkAce from Kovah. Versions earlier than 2.5.3 are vulnerable. Version 2.5.3 and later contain a fix that correctly enforces note visibility on the web link detail page.

The CVSS base score is 6.5, indicating a moderate severity, and the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalogue. Exploitation requires only an authenticated user with access to the web interface; the attacker does not need elevated privileges or code execution. Consequently, any legitimate user can readily trigger the data disclosure by visiting a link’s detail page, making the risk significant for organizations that rely on private notes for sensitive information.