CVE-2026-85605
Medium
Description
Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.
SeverityMedium
CVSS5.3
Exploit probability—
ProductAndrii-kryvoviaz Slink
PublishedSep 4, 2026
First seenSep 4, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- andrii-kryvoviaz slink1.12.3 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| andrii-kryvoviaz slink | v < 1.12.3 | 1.12.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.