CVE-2026-85605: Slink Authentication Bypass Vulnerability

CVE-2026-85605 Overview

CVE-2026-85605 is a missing authorization vulnerability [CWE-862] in Slink, an open-source image hosting application, affecting versions prior to 1.12.3. The application fails to enforce authorization on image comment endpoints. Unauthenticated attackers can read comment threads via GET /api/image/{imageId}/comments and subscribe to live comment updates through server-sent events (SSE). Attackers who obtain image IDs out of band can retrieve full comment threads on public images without any authentication or authorization checks.

Critical Impact

Unauthenticated remote attackers can read comment threads and subscribe to live comment updates for any image whose ID they know, exposing potentially sensitive user-generated content.

Affected Products

• Slink versions prior to 1.12.3
• Slink REST API endpoint GET /api/image/{imageId}/comments
• Slink Mercure-based server-sent events subscription channel comments/*

Discovery Timeline

• 2026-09-04 - CVE-2026-85605 published to the National Vulnerability Database (NVD)
• 2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85605

Vulnerability Analysis

Slink exposes an image commenting feature that supports both request-based retrieval and real-time updates via the Mercure hub. Prior to version 1.12.3, neither the REST endpoint nor the SSE subscription channel enforced access control against the requesting principal. Any client who knew or guessed an image identifier could read the full comment thread and receive live updates when new comments were posted.

The underlying issue is missing authorization [CWE-862] on read paths. The application logic assumed that possession of an image ID implied entitlement to see its comments, and no voter or policy check ran before returning data. This design flaw affected both the synchronous HTTP API and the asynchronous SSE stream.

Root Cause

Two code paths were unprotected. The Caddy reverse proxy configuration for Mercure allowed anonymous subscribers to receive events published to the comments/* topic pattern. In the application layer, comment create and view flows in the Slink\Comment domain lacked an AuthorizationCheckerInterface gate before executing.

Attack Vector

The attack requires network access to the Slink instance and knowledge of one or more image IDs. IDs may be harvested from public pages, shared links, referrer headers, or enumeration. An attacker then issues a GET request to /api/image/{imageId}/comments or opens an SSE connection to the Mercure hub subscribing to comments/*. No credentials or session are needed.

# Patch: docker/config/caddy/Caddyfile
# Restrict anonymous Mercure subscribers to a public-feed topic only
		publisher_jwt {env.MERCURE_JWT_SECRET}
		subscriber_jwt {env.MERCURE_JWT_SECRET}
		anonymous {
-			subscribe comments/*
+			subscribe public-feed
		}
		cors_origins *
		publish_origins *

Source: GitHub Commit 221315b

// Patch: CreateCommentHandler.php
// Gate comment creation behind an authorization voter
 use Slink\Comment\Domain\Comment;
+use Slink\Comment\Domain\Enum\CommentAccess;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;

 final readonly class CreateCommentHandler implements CommandHandlerInterface {
   public function __construct(
     private CommentStoreRepositoryInterface $commentStore,
+    private AuthorizationCheckerInterface $access,
   ) {
   }

   public function __invoke(CreateCommentCommand $command, string $imageId, string $userId): ID {
+    if (!$this->access->isGranted(CommentAccess::Create, $imageId)) {
+      throw new NotFoundException();
+    }
+
     $commentId = ID::generate();

Source: GitHub Commit fe04a7d

Detection Methods for CVE-2026-85605

Indicators of Compromise

• Unauthenticated HTTP GET requests to /api/image/{imageId}/comments originating from external IPs or scraping user agents.
• Anonymous Mercure SSE subscriptions to the comments/* topic pattern in Caddy or reverse proxy logs.
• High-volume enumeration of image IDs against the comments API from a single source.

Detection Strategies

• Parse web server access logs for requests to /api/image/*/comments that lack a session cookie or bearer token, and correlate by source IP.
• Alert on Mercure hub connections subscribing to comments/* without a valid subscriber JWT.
• Baseline normal comment API traffic per authenticated user and flag anonymous access above that baseline.

Monitoring Recommendations

• Forward Slink application and Caddy reverse proxy logs to a centralized log platform for retention and query.
• Track the ratio of authenticated to unauthenticated requests on comment endpoints as a leading indicator of abuse.
• Monitor egress volume from the Mercure hub for sustained anonymous SSE sessions.

How to Mitigate CVE-2026-85605

Immediate Actions Required

• Upgrade all Slink deployments to version 1.12.3 or later without delay.
• Rotate the MERCURE_JWT_SECRET after upgrading if the hub was previously exposed to untrusted networks.
• Audit historical logs for anonymous access to /api/image/*/comments and the comments/* SSE topic.

Patch Information

The fix is available in Slink release v1.12.3. The patch introduces a Symfony AuthorizationCheckerInterface voter (CommentAccess) gating comment view and creation, and restricts anonymous Mercure subscribers to a public-feed topic instead of comments/*. Details are documented in GHSA-hxx4-4hwq-8258 and the VulnCheck advisory.

Workarounds

• If immediate patching is not possible, block unauthenticated access to /api/image/*/comments at the reverse proxy.
• Modify the Caddy Mercure configuration to remove the subscribe comments/* grant from the anonymous block.
• Place the Slink instance behind a VPN or IP allowlist until the upgrade is applied.

# Configuration example: restrict anonymous Mercure subscriptions in Caddyfile
mercure {
    publisher_jwt {env.MERCURE_JWT_SECRET}
    subscriber_jwt {env.MERCURE_JWT_SECRET}
    anonymous {
        subscribe public-feed
    }
    cors_origins *
    publish_origins *
}