Executive brief
Shlink is a self-hosted URL shortener that manages links and access permissions through API keys with role-based restrictions (e.g., author-only or domain-only keys). A vulnerability in how Shlink issues Mercure subscription tokens fails to enforce these role restrictions, allowing attackers with limited API keys to subscribe to all topics and access sensitive visit analytics (referrer, user agent, geolocation, and full URLs) outside their authorized scope. This could expose business intelligence and user behavior data intended to be restricted to certain administrators or domain owners.
Technical details
The vulnerability is an authorization bypass in Shlink versions through 5.1.6 where API key role restrictions are not properly enforced when generating Mercure subscription tokens. Specifically, the `LcobucciJwtProvider::buildSubscriptionToken()` method issues tokens with a wildcard subscribe claim (`['subscribe' => ['*']]`) regardless of the originating API key's assigned roles. Attackers with author-only or domain-only API keys can exploit this by accessing the `mercure-info` endpoint, which returns visit data (referrer, user agent, geolocation, and full short URL objects) for all tracked links, not just those within their authorization boundary. The attack requires network access to the Shlink instance and valid (but restricted) API credentials; no additional user interaction is needed. Patches are expected to be available in versions after 5.1.6.
Affected products
- Shlink Shlink through 5.1.6
Timeline
- 2026-09-16: disclosed