Medium severity6.5NVD Advisory· Published Sep 16, 2026

CVE-2026-92760

Description

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.

Affected products

Shlinkio/Shlink Commonreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=5.1.6
Shlinkio/Shlinkllm-fuzzy
Range: <=5.1.6

Patches

Vulnerability mechanics

References

github.com/shlinkio/shlink-common/blob/main/src/Mercure/LcobucciJwtProvider.phpnvd
github.com/shlinkio/shlink/blob/v5.1.6/module/Rest/src/Action/MercureInfoAction.phpnvd
github.com/shlinkio/shlink/issues/2633nvd
www.vulncheck.com/advisories/shlink-through-5.1.6-mercure-token-authorization-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000