EUVD-2026-81028
GHSA-r72g-8wq6-6m7w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, low complexity, but requires a valid restricted API key so PR:L; confidentiality-only disclosure of cross-tenant visit data gives C:H, I:N, A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.
AnalysisAI
Information disclosure in Shlink through 5.1.6 allows an attacker who already holds a role-restricted API key (author-only or domain-only) to read visit analytics - referrer, user agent, geolocation and full short-URL objects - for links outside that key's authorization boundary. The mercure-info endpoint mints a Mercure subscription JWT without applying the API key's role restrictions, so the scoped credential can subscribe to every topic rather than only its own. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already possess a valid but role-restricted Shlink API key (an author-only or domain-only key) - this is the core prerequisite and the primary limiter, meaning exploitation is confined to actors who have been provisioned a scoped credential (multi-tenant or delegated deployments). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded confidentiality-only authorization flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch availability is not confirmed from the provided data - no fixed release version is given by the vendor or in the references, which point only to issue https://github.com/shlinkio/shlink/issues/2633 - so track that issue and the https://github.com/shlinkio/shlink repository for the first release after 5.1.6 that applies the API key's role restrictions when minting Mercure subscription tokens, then upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Shlink instances and confirm which are running 5.1.6 or earlier, then determine whether Mercure real-time updates are configured and enabled; if they are enabled and not business-critical, disable the Mercure integration or block the mercure-info endpoint at the reverse proxy, API gateway, or WAF, and audit every role-restricted API key (author-only and domain-only) to revoke unused or stale keys and rotate those that must remain active. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today