The vulnerability is an Insecure Direct Object Reference that permits any authenticated user to update link, list, tag, and note resources belonging to other users if the resources are public or internally visible. The flaw resides in the update methods of the policies that mistakenly grant access based on visibility, not ownership, thus allowing attackers to overwrite content across the entire instance. The attack could lead to unauthorized data modification, reputational damage, and potential compromise of organizational knowledge bases.

This issue affects Kovah's LinkAce application in versions older than 2.5.6. It impacts both the web user interface and REST API, and also interferes with bulk edit operations handled by BulkEditController. Systems running any release prior to 2.5.6 are vulnerable.

The CVSS score of 7.1 indicates a high severity for authenticated users. EPSS data is not available, so the exact exploitation probability is uncertain, but the lack of a KEV listing does not reduce the risk of exploitation. The attack requires legitimate login credentials, after which any public or internally visible resource can be arbitrarily modified. The flaw is not mitigated by role restrictions alone; only ownership checks would prevent the abuse.