CVE-2026-85605

    Dashboard / Vulnerabilities / CVE-2026-85605

    CVE-2026-85605

    Published: 4 Sept 2026Last Modified: 25 Sept 2026

    Summary: Slink before 1.12.3 Missing Authorization on Image Comment Endpoints

    Details: Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85605.json, https://github.com/andrii-kryvoviaz/slink/releases/tag/v1.12.3, https://github.com/andrii-kryvoviaz/slink/security/advisories/GHSA-hxx4-4hwq-8258, https://nvd.nist.gov/vuln/detail/CVE-2026-85605, https://www.vulncheck.com/advisories/slink-before-1.12.3-missing-authorization-on-image-comment-endpoints, https://github.com/andrii-kryvoviaz/slink/commit/221315b1ac51, https://github.com/andrii-kryvoviaz/slink/commit/fe04a7dffe8a7ed2f834f7364281a9414e394600, https://github.com/andrii-kryvoviaz/slink

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0a683ccb6fdf26265bf015a50db5671380e73414

    Affected versions

    v1.12.2
    v1.12.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-85605 | CVE-DB