Linqi vulnerabilities
We track 3 vulnerabilities in Linqi products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 5, 2026.
Latest Linqi vulnerabilities
- 7.1 High severity
linqi: Authorization Bypass Through User-Controlled Key
The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDO
- 8.5 High severity
linqi: Use of Hard-coded Cryptographic Key
The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible.
- 7.5 High severity
linqi: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in linqi before 1.4.0.1 on Windows. There is an NTLM hash leak via the /api/Cdn/GetFile and /api/DocumentTemplate/{GUID] endpoints.