Is CVE-2026-92760 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92760?

CVE-2026-92760 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-92760

Description

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.