MEDIUM

CVE-2026-92760

2026-09-16 CVSS v3.1

CVSS

6.5

Description

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.

Weakness (CWE)

CWE-863 Incorrect Authorization

EPSS Score

0.4%

Probability of exploitation in next 30 days

33.8th percentile

References

https://github.com/shlinkio/shlink https://github.com/shlinkio/shlink-common/blob/main/src/Mercure/LcobucciJwtProvider.php#L38-L41 https://github.com/shlinkio/shlink/blob/v5.1.6/module/Rest/src/Action/MercureInfoAction.php#L26-L42 https://github.com/shlinkio/shlink/issues/2633 https://www.vulncheck.com/advisories/shlink-through-5.1.6-mercure-token-authorization-bypass

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE