CVE-2026-85605

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85605
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85605.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85605
Aliases
  • GHSA-hxx4-4hwq-8258
Published
2026-09-04T14:32:07Z
Modified
2026-10-28T02:30:43Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Slink before 1.12.3 Missing Authorization on Image Comment Endpoints
Details

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85605.json"
}
References

Affected packages

Git / github.com/andrii-kryvoviaz/slink

Affected ranges

Type
GIT
Repo
https://github.com/andrii-kryvoviaz/slink
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0a683ccb6fdf26265bf015a50db5671380e73414
Fixed
fe04a7dffe8a7ed2f834f7364281a9414e394600
Fixed
221315b1ac51
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.12.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "fe04a7dffe8a7ed2f834f7364281a9414e394600"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "221315b1ac51"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.12.3",
            "range": [
                {
                    "fixed": "0a683ccb6fdf26265bf015a50db5671380e73414"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.0-rc.10
v1.0.0-rc.11
v1.0.0-rc.5
v1.0.0-rc.6
v1.0.0-rc.7
v1.0.0-rc.8
v1.0.0-rc.9
v1.0.0-rc1
v1.0.0-rc2
v1.0.0-rc3
v1.0.0-rc4
v1.0.1
v1.1.0
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.10.5
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.11.4
v1.11.5
v1.11.6
v1.12.1
v1.12.2
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85605.json"