Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-116052: LinkStack can be tricked into unauthorized actions
CVE-2026-116052 · published 10 days ago
Summary
The LinkStack web tool (versions up to 4.8.8) contains a weakness that lets an attacker cause a logged‑in user’s browser to perform actions they did not intend, such as changing settings or submitting data. This could allow someone to manipulate the service on the user’s behalf without their knowledge. Apply any available updates from the vendor immediately and consider adding extra checks like multi‑factor authentication and activity monitoring until the issue is resolved.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| linkstackorg | linkstack | 4.8.0 |
Original advisory text
LinkStackOrg LinkStack cross-site request forgery
A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
References
- https://vuldb.com/vuln/426136 vdb-entry
- https://vuldb.com/vuln/426136/cti signature permissions-required
- https://vuldb.com/cve/CVE-2026-116052 third-party-advisory
- https://vuldb.com/submit/995635 third-party-advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-352Cross-Site Request Forgery (CSRF)
CWE-862Missing Authorization
Timeline
Published25 Oct 2026
Updated31 Oct 2026
First seen25 Oct 2026
Track software like this
Free during beta