Vulnerability Description
Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/andrii-kryvoviaz/slink
- https://github.com/andrii-kryvoviaz/slink/commit/221315b1ac51
- https://github.com/andrii-kryvoviaz/slink/commit/fe04a7dffe8a7ed2f834f7364281a94
- https://github.com/andrii-kryvoviaz/slink/releases/tag/v1.12.3
- https://github.com/andrii-kryvoviaz/slink/security/advisories/GHSA-hxx4-4hwq-825
- https://www.vulncheck.com/advisories/slink-before-1.12.3-missing-authorization-o
FAQ
What is CVE-2026-85605?
CVE-2026-85605 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-even...
How severe is CVE-2026-85605?
CVE-2026-85605 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85605?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.