This vulnerability targets the saveLink function in the UserController of LinkStack's management endpoint. The function accepts link data from remote users and, due to missing authorization checks, allows an attacker to craft requests that bypass standard user permissions, creating or updating links without proper privilege. This flaw falls under CWE‑285 (Improper Authorization) and CWE‑639 (Authorization Bypass Through User-Controlled Key). The impact is the ability for an unauthenticated or low‑privileged user to perform actions normally restricted to higher‑privileged roles, potentially leading to unauthorized data exposure or subsequent privilege escalation.

LinkStack by LinkStackOrg, versions 4.8.6 and earlier. The vulnerability was detected in these releases up to 4.8.6 and remains unpatched until a new release is issued.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The description states the attack can be initiated remotely, and the exploit has been publicly disclosed and may be used. As the pull request to fix the issue has not yet been merged, no official patch exists; attackers can potentially exploit this flaw until a downstream fix is applied.