CVE-2026-85605 in Slink
Summary
by MITRE • 09/04/2026
Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in Slink versions prior to 1.12.3 represents a critical failure in access control mechanisms, specifically classified under CWE-862 Missing Authorization. This flaw allows unauthenticated actors to bypass security controls that should restrict access to sensitive data endpoints. The core technical issue lies in the application's inability to properly validate user permissions before processing requests directed at image comment interfaces. By failing to enforce authentication or authorization checks on these specific API routes, the system inadvertently exposes internal logic and private data structures to any external entity capable of constructing valid HTTP requests.
The operational impact is significant as it enables information disclosure through two primary vectors: direct RESTful API access via GET /api/image/{imageId}/comments and real-time updates using server-sent events subscriptions. Attackers who can obtain image identifiers out-of-band, such as from public URLs or other data leaks, are able to retrieve complete comment threads associated with those images without any form of credential validation. This capability extends beyond static data retrieval; the vulnerability also permits attackers to subscribe to live streams of new comments via server-sent events. Consequently, an adversary can monitor real-time interactions on public images, potentially gathering intelligence on user behavior, identifying active accounts through their commenting patterns, or scraping content for malicious purposes such as phishing campaigns or social engineering attacks.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts if the attacker leverages compromised credentials to escalate privileges, but more accurately reflects T1539 Steal Web Session Cookie when considering potential session hijacking implications derived from exposed user data, and primarily falls under Information Discovery. The lack of proper authorization checks means that any image ID known to an attacker becomes a gateway to sensitive conversation history. This exposure violates the principle of least privilege by granting read access to resources without verifying if the requester has been granted permission for that specific resource instance.
Mitigation strategies must focus on implementing robust authentication and authorization middleware across all API endpoints, particularly those handling user-generated content like comments. Developers should ensure that every request to /api/image/{imageId}/comments undergoes a strict identity verification process followed by an access control check to confirm the requester's permission level relative to the specific image resource. For server-sent event subscriptions, similar validation logic must be applied at the connection establishment phase to prevent unauthenticated listeners from attaching to data streams. Upgrading Slink to version 1.12.3 or later is the primary remediation step as it addresses these authorization gaps. Additionally, implementing rate limiting and monitoring for unusual patterns of comment retrieval can help detect potential exploitation attempts in real-time while longer-term architectural improvements are deployed.