CVE-2026-92760 Overview
CVE-2026-92760 is an authorization bypass vulnerability in Shlink versions through 5.1.6, an open-source URL shortener. The flaw resides in how Shlink issues Mercure subscription tokens through the mercure-info endpoint. The application fails to enforce API key role restrictions when generating these JSON Web Tokens (JWTs), granting restricted keys subscription rights to all Mercure topics. Attackers holding author-only or domain-only API keys can subscribe to real-time visit streams outside their authorization boundary. The exposed data includes referrer URLs, user-agent strings, geolocation details, and complete short URL objects. This weakness is classified under CWE-863: Incorrect Authorization.
Critical Impact
Restricted API key holders can subscribe to Mercure topics for short URLs they should not access, exposing visitor telemetry and short URL metadata across tenants and domains.
Affected Products
- Shlink versions through 5.1.6
- Shlink MercureInfoAction REST endpoint
- Shlink Mercure subscription integration via LcobucciJwtProvider
Discovery Timeline
- 2026-09-16 - CVE-2026-92760 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92760
Vulnerability Analysis
Shlink integrates with Mercure, a protocol for real-time updates over HTTP, to push visit events to subscribers. Clients obtain a Mercure subscription JWT by calling the mercure-info REST endpoint. The endpoint authenticates the caller with a Shlink API key, then requests a JWT from the LcobucciJwtProvider service.
The provider signs a token whose subscription claim grants access to all topics, regardless of the API key role. Shlink supports role-scoped keys such as AUTHORED_SHORT_URLS (author-only) and DOMAIN_SPECIFIC (domain-only), which normally restrict REST responses to a subset of short URLs. These role restrictions are applied at the REST layer but not propagated into the Mercure token issuance path.
As a result, any authenticated API key can subscribe to visit streams for every short URL in the instance. The impact is scoped to confidentiality of visit telemetry and short URL objects; the vulnerability does not enable modification or deletion.
Root Cause
The root cause is missing authorization enforcement in the Mercure token issuance flow. The LcobucciJwtProvider builds the subscription claim without consulting the caller's API key role or the topic scope that role permits. See the JWT provider source and the Mercure info action for the relevant code paths.
Attack Vector
An attacker authenticates to Shlink with a restricted API key and issues an HTTP GET request to the mercure-info endpoint. Shlink returns a Mercure JWT and the hub URL. The attacker connects to the Mercure hub as a subscriber using that JWT and receives events for topics outside their authorization boundary. Exploitation requires only network access to the Shlink REST API and a valid low-privilege key.
No verified public exploit code is available. Refer to GitHub Issue #2633 and the VulnCheck advisory for reproduction details.
Detection Methods for CVE-2026-92760
Indicators of Compromise
- Requests to the /rest/v*/mercure-info endpoint from API keys that hold AUTHORED_SHORT_URLS or DOMAIN_SPECIFIC roles.
- Mercure hub subscription connections presenting Shlink-issued JWTs whose subscribe claim is * while originating from restricted keys.
- Unusual volumes of Mercure event delivery to clients that historically only used scoped REST endpoints.
Detection Strategies
- Correlate Shlink REST access logs with Mercure hub subscription logs to identify keys receiving events for short URLs they cannot query over REST.
- Decode issued Mercure JWTs and alert when the mercure.subscribe claim contains * for non-admin keys.
- Track baseline call patterns for mercure-info and flag first-time callers using restricted API keys.
Monitoring Recommendations
- Enable verbose Shlink REST logging and forward events, along with Mercure hub logs, to a centralized analytics platform for cross-source correlation.
- Monitor egress connections from Shlink to the Mercure hub and alert on subscription topics that span multiple tenants or domains.
- Audit API key inventory and revoke unused or overly privileged keys, then review recent mercure-info usage per key.
How to Mitigate CVE-2026-92760
Immediate Actions Required
- Upgrade Shlink to a patched release once available and track the fix status in GitHub Issue #2633.
- Rotate all Shlink API keys, especially restricted keys that may have been used to obtain Mercure tokens.
- Restrict network access to the Shlink REST API and Mercure hub to trusted clients while a fix is being deployed.
- Review historical Mercure hub logs to assess whether restricted keys received visit data outside their scope.
Patch Information
At publication, no fixed release is referenced in the NVD entry. Monitor the Shlink repository and the VulnCheck advisory for the version that enforces API key role scoping in the Mercure token provider.
Workarounds
- Disable the Mercure integration in Shlink configuration if real-time visit events are not required.
- Issue only admin-equivalent API keys to trusted operators and avoid distributing AUTHORED_SHORT_URLS or DOMAIN_SPECIFIC keys until a patch is applied.
- Place the Mercure hub behind a reverse proxy that authenticates and authorizes subscription requests independently of the Shlink-issued JWT.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
