# CVE-2026-92760: Shlink authorization bypass in Mercure subscription tokens

Source: https://junglewise.ai/threats/cve-2026-92760-shlink-authorization-bypass-in-mercure-subscription-tokens  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92760 · Severity: medium · CVSS 6.5 · Published 2026-09-16

Shlink is a self-hosted URL shortener that manages links and access permissions through API keys with role-based restrictions (e.g., author-only or domain-only keys). A vulnerability in how Shlink issues Mercure subscription tokens fails to enforce these role restrictions, allowing attackers with limited API keys to subscribe to all topics and access sensitive visit analytics (referrer, user agent, geolocation, and full URLs) outside their authorized scope. This could expose business intelligence and user behavior data intended to be restricted to certain administrators or domain owners.

Technologies: [Shlink](https://junglewise.ai/threats/technologies/shlink). Vendors: [Shlink](https://junglewise.ai/threats/vendors/shlink).

## Quick answers

**Is CVE-2026-92760 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92760 being exploited in the wild.

**How severe is CVE-2026-92760?** Medium severity, with a CVSS score of 6.5, published 16 September 2026.

**Which products and versions are affected?** Shlink through 5.1.6.

**Is there a fix for CVE-2026-92760?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92760 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92760?** Check whether you run Shlink at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in Shlink versions through 5.1.6 where API key role restrictions are not properly enforced when generating Mercure subscription tokens. Specifically, the `LcobucciJwtProvider::buildSubscriptionToken()` method issues tokens with a wildcard subscribe claim (`['subscribe' => ['*']]`) regardless of the originating API key's assigned roles. Attackers with author-only or domain-only API keys can exploit this by accessing the `mercure-info` endpoint, which returns visit data (referrer, user agent, geolocation, and full short URL objects) for all tracked links, not just those within their authorization boundary. The attack requires network access to the Shlink instance and valid (but restricted) API credentials; no additional user interaction is needed. Patches are expected to be available in versions after 5.1.6.

## Affected products

- Shlink Shlink through 5.1.6

## Timeline

- 2026-09-16: disclosed

## References

- [https://github.com/shlinkio/shlink](https://github.com/shlinkio/shlink)
- [https://github.com/shlinkio/shlink-common/blob/main/src/Mercure/LcobucciJwtProvider.php](https://github.com/shlinkio/shlink-common/blob/main/src/Mercure/LcobucciJwtProvider.php)

## Related threats

- [Shlink CSV formula injection in visit exports](https://junglewise.ai/threats/cve-2026-18738-shlink-csv-formula-injection-in-visit-exports)
- [Shlink blind SQL injection in tag statistics endpoint](https://junglewise.ai/threats/cve-2026-18737-shlink-blind-sql-injection-in-tag-statistics-endpoint)
- [Shlink server-side request forgery in title resolution](https://junglewise.ai/threats/cve-2026-18736-shlink-server-side-request-forgery-in-title-resolution)
- [Shlink SSRF in automatic short URL title resolution](https://junglewise.ai/threats/cve-2026-50887-shlink-ssrf-in-automatic-short-url-title-resolution)