Linkding's Proxy Login Can Leave an API Bypass
Linkding is a bookmark service. It supports multiple users, shared bookmarks, a REST API, and optional authentication proxy support. That combination is convenient for a small self-hosted deployment, and it creates several ways into the same data.
The measurement
On 2026-10-30, ZoomEye count-only queries used sub_type=all, page 1, and page size 1. app="linkding" returned 0. title="linkding" returned 2,278.
The title result is a separate product-name observation. It does not identify which matches are personal, shared, or exposed without authentication. The app query's zero means the selected fingerprint had no match in this scope. Neither value should be used as a vulnerability count.
Authentication proxy behavior
The linkding options documentation explains that an authentication proxy can sit in front of the application. API clients may need to bypass that proxy because they authenticate with an API token instead of completing the browser login flow.
That bypass is the critical test. If the bypass route is broader than the API prefix, an ordinary browser path may reach the application without the proxy. If the main listener is reachable by address or alternate port, the proxy is no longer the only gate.
Test with a browser and a command-line client from separate test users. Confirm that the browser route cannot be used without the proxy identity. Confirm that an API token grants only the intended user's data. Repeat after disabling a user and revoking the token.
Shared bookmarks and guest access
Linkding supports sharing bookmarks with other users or guests. That can expose URLs, titles, descriptions, tags, and notes if those fields are included. Treat a shared bookmark as a data object, not as a harmless link.
Review which users can enable sharing and whether a public view can be enumerated. Check that the shared view does not reveal another user's private bookmarks through a predictable identifier. Use synthetic bookmarks for the test.
The application also documents restrictions around internal hosts and redirects, including a setting for allowed internal hosts. Those controls matter because a bookmark service fetches or previews remote content in some workflows. Do not assume that a stored URL is harmless because it is only a text field.
Inventory questions
- What hostnames and ports serve the browser UI and API?
- Is the main listener reachable without the proxy?
- Which routes bypass proxy authentication?
- Who can create shared links or guest views?
- Are API tokens inventoried and revocable?
- Do users understand what metadata a share exposes?
Keep the exact query and count with the asset. Then attach a local test that shows whether the proxy path and API path are separate as intended. The title count locates a product class. The route test shows whether the data boundary is real.
Top comments (0)