CVE-2026-85605

Name of the Vulnerable Software and Affected Versions Slink versions prior to 1.12.3

Description Improper authorization in image comment endpoints allows unauthenticated attackers to read comment threads. By obtaining image IDs out of band, an attacker can retrieve full comment threads on public images and subscribe to live comment updates. This is possible via the endpoint 'GET /api/image/{imageId}/comments' and server-sent-events subscriptions, which lack necessary authentication or authorization checks.

Recommendations Update to version 1.12.3 or later. Restrict access to the 'GET /api/image/{imageId}/comments' endpoint as a temporary mitigation.