CVE-2026-85605: Slink before 1.12.3 Missing Authorization on Image Comment Endpoints
Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Slinkto a version that resolves this vulnerability.Fixed in 1.12.3 - Compensating control
Restrict or firewall access to the image comment endpoints (/api/image/{imageId}/comments) and any server-sent-events subscription routes until Slink is upgraded to 1.12.3.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs an image ID obtained out of band. No authentication, authorization, user interaction, or special access is required to retrieve comments or subscribe to live updates.
Which data can be exposed?
Full comment threads associated with public images can be read through the image comment GET endpoint. An attacker can also receive live comment updates through server-sent-events subscriptions.
Are deployments affected by default?
The issue affects Slink versions before 1.12.3 where the image comment endpoints are available. The described exposure applies to comments on public images.
How can I check for exposure?
Review whether an unauthenticated request to GET /api/image/{imageId}/comments returns comment data for a known public image ID. Also verify whether an unauthenticated client can establish a server-sent-events subscription for that image's comments.
What should be done if upgrading is not immediately possible?
Restrict unauthenticated access to the affected image comment and server-sent-events endpoints, such as through a reverse proxy or other access-control layer. Treat image IDs as insufficient protection because IDs obtained out of band can be used to access the comments.