---
id: CVE-2026-85605
title: >-
  Slink before 1.12.3 fails to properly authorize access to image comment
  endpoints, allowing unauthenticated attackers to read comment threads via GET
  /api/image/{imageId}/comments and server-sent-events subscriptions
summary: >-
  Slink before 1.12.3 fails to properly authorize access to image comment
  endpoints, allowing unauthenticated attackers to read comment threads via GET
  /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers
  who obtai…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-862
published: '2026-09-04'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:45.753'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85605'
references:
  - url: 'https://github.com/andrii-kryvoviaz/slink'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/andrii-kryvoviaz/slink/commit/221315b1ac51'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/andrii-kryvoviaz/slink/commit/fe04a7dffe8a7ed2f834f7364281a9414e394600
    label: disclosure@vulncheck.com
  - url: 'https://github.com/andrii-kryvoviaz/slink/releases/tag/v1.12.3'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/andrii-kryvoviaz/slink/security/advisories/GHSA-hxx4-4hwq-8258
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/slink-before-1.12.3-missing-authorization-on-image-comment-endpoints
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.0039
epssPercentile: 0.32996
ingestedAt: '2026-09-23T17:28:14.823Z'
---

## Overview

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.