CVE-2026-92760

EUVD-2026-81028
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/shlinkio/shlink
https://github.com/shlinkio/shlink-common/blob/main/src/Mercure/LcobucciJwtProvider.php#L38-L41
https://github.com/shlinkio/shlink/blob/v5.1.6/module/Rest/src/Action/MercureInfoAction.php#L26-L42
https://github.com/shlinkio/shlink/issues/2633
https://www.vulncheck.com/advisories/shlink-through-5.1.6-mercure-token-authorization-bypass