CVE-2026-92760

Shlink, a self-hosted URL shortener, through version 5.1.6 fails to enforce API key role restrictions when issuing Mercure real-time subscription tokens, so keys scoped to specific authors or domains receive tokens valid for all topics (CWE-863, incorrect authorization). An attacker who already holds an author-only or domain-only API key can call the mercure-info endpoint and subscribe to topics outside their authorization boundary. This exposes live visit data — including referrer, user agent, and geolocation — plus full short URL objects for URLs the key should not be able to see, a high-confidentiality issue with no integrity or availability impact. Only deployments running Shlink 5.1.6 or earlier that issue restricted API keys to third parties or limited users are materially affected. No public proof-of-concept is known, the issue is not in CISA KEV, and no exploitation has been reported.

What to do: Upgrade to a Shlink release newer than 5.1.6 that enforces API key roles in Mercure subscription tokens as soon as one is available. Until then, rotate or restrict author-only and domain-only API keys, limit external access to the Mercure hub and mercure-info endpoint (e.g., at the reverse proxy), and review hub/subscription logs for topic access outside authorized boundaries.