Description
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| shlinkio | shlink | ≤ 5.1.6 | — |
References
- GitHub Issue #2633 issue-tracking
- https://github.com/shlinkio/shlink product
- MercureInfoAction issues a subscription token without reference to the API key technical-description
- buildSubscriptionToken emits the subscribe ['*'] claim technical-description
- VulnCheck Advisory: Shlink through 5.1.6 Mercure Token Authorization Bypass third-party-advisory