CVE-2026-45343: LinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session Hijacking

Synopsis

Stored cross-site scripting (XSS) in LinkAce allows a low-privilege authenticated user to plant a persistent JavaScript payload in the administrator audit log. The attack requires only a low-privilege account via SSO/OAuth and passive victim interaction: an admin simply navigating to /system/audit triggers the payload in their browser. Successful exploitation gives the attacker full control over the admin session, enabling session cookie theft, CSRF token exfiltration, and arbitrary admin-level actions. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the LinkAce instance over the network to authenticate via SSO/OAuth and plant the payload; the victim admin must also reach the audit log endpoint over the network.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker only needs a valid SSO/OAuth identity to set a malicious display name and create an API token.

• Victim interactionRequired

  An administrator must navigate to /system/audit in their browser for the stored payload to execute, making this a passive social-engineering or wait-for-routine-action scenario.

• Attack complexityDetail

  The exploit is reliable and condition-free once the payload is planted; no race conditions or special environmental factors are required to trigger execution.

Blast Radius

• Reads the admin session cookie, allowing the attacker to authenticate as the administrator from a separate session.
• Extracts the CSRF token exposed in the la-app-data meta tag, enabling forged state-changing requests on behalf of the admin.
• Performs any action the admin can take inside LinkAce, including modifying link archives, managing users, or changing system configuration.