Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92760Shlink through 5.1.6 Mercure Token Authorization Bypass

Medium 6.5

In plain English

A medium-severity incorrect authorization in shlink from shlinkio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.

Affected products (as reported)

Vendor	Product	Versions
shlinkio	shlink	0 – through 5.1.6

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #2633 issue-tracking
https://github.com/shlinkio/shlink product
MercureInfoAction issues a subscription token without reference to the API key technical-description
buildSubscriptionToken emits the subscribe ['*'] claim technical-description
VulnCheck Advisory: Shlink through 5.1.6 Mercure Token Authorization Bypass third-party-advisory