CVE-2026-92760
mediumShlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics.
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/shlinkio/shlink disclosure@vulncheck.com
- https://github.com/shlinkio/shlink-common/blob/main/src/Mercure/LcobucciJwtProvider.php#L3... disclosure@vulncheck.com
- https://github.com/shlinkio/shlink/blob/v5.1.6/module/Rest/src/Action/MercureInfoAction.ph... disclosure@vulncheck.com
- https://github.com/shlinkio/shlink/issues/2633 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/shlink-through-5.1.6-mercure-token-authorization-bypa... disclosure@vulncheck.com
- https://github.com/shlinkio/shlink/issues/2633 134c704f-9b21-4f2e-91b3-4a467353bcc0