Live › vulnerability › CVE-2026-116052
Go to dashboardLinkStack, a self-hosted link-in-bio web application, has a cross-site request forgery flaw in an unspecified function in versions up to 4.8.8. A remote attacker who tricks a logged-in user into visiting a malicious page could make that user's browser perform actions on the LinkStack site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 13:41 UTC. All times on this page are UTC.
Teams that self-host LinkStack up to version 4.8.8 and have logged-in administrators or users who browse other sites while signed in. The sources do not say which function is exposed, so the exact exposure is unknown. Instances on a newer release, or without authenticated users, are likely not affected, but the sources do not confirm this.
No product ranges from the sources yet.
4.8.8; unknown whether later builds are fixed.4.8.8 once the vendor publishes one; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116052")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.