https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T19:19:34.949210+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-92760 fkie_cve-2026-92760 2026-09-30T19:19:34.967565+00:00

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.

 https://db.gcve.eu/vuln/ghsa-r72g-8wq6-6m7w GHSA-r72g-8wq6-6m7w 2026-09-30T19:19:34.967632+00:00

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.