CVE-2026-92760: Shlink through 5.1.6 Mercure Token Authorization Bypass
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
shlinkto a version that resolves this vulnerability.Fixed in 5.1.6 - Compensating control
Ensure Mercure subscription token issuance enforces API key role restrictions so author-only or domain-only keys cannot subscribe beyond their authorization boundary (topics outside their permitted scope).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid author-only or domain-only API key. With one of those restricted keys, they can obtain Mercure subscription tokens that are not limited to the key’s authorized topics.
What information could an unauthorized subscriber receive?
The affected Mercure subscription access can expose visit data for short URLs outside the API key’s authorization boundary. This includes referrer, user-agent, geolocation, and full short URL objects.
How can an organization determine whether it is exposed?
Systems running Shlink through 5.1.6 are affected if restricted author-only or domain-only API keys are issued and the mercure-info endpoint is accessible to those keys. Review whether such keys can request Mercure subscription information and receive topics beyond their assigned scope.