Description

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T15:17:41.233Z",
  "pubdate": "2026-09-04T15:17:41.233Z",
  "executiveSummary": "The vulnerability identified in Slink prior to version 1.12.3 is an improper authorization flaw that permits unauthenticated users to access sensitive image comment data.\nThe security defect specifically impacts the /api/image/{imageId}/comments endpoint and related server-sent-events (SSE) mechanisms.\nThis vulnerability constitutes a broken access control issue, allowing unauthorized entities to exfiltrate full comment threads and monitor real-time communications associated with specific image IDs.\nAn attacker does not require valid credentials or high-level privileges to exploit this flaw, provided they can obtain a target image ID through out-of-band methods.\nThe risk implication is significant regarding information disclosure, as the system fails to validate user authorization before serving protected resources.\nThe exploitation requirement is minimal, necessitated only by the acquisition of a valid resource identifier, facilitating broad unauthorized data access across the platform.",
  "technicalDetails": "The vulnerability resides within the authorization middleware governing the API layer of Slink, specifically regarding resource-level access control checks for comment thread retrieval.\nThe root cause is a failure to enforce authentication or authorization constraints on the GET /api/image/{imageId}/comments endpoint and its associated real-time SSE stream listeners.\nIn affected versions prior to 1.12.3, the application logic assumes that resource identifiers are sufficient for access, failing to verify the caller's session state or permission set against the requested image resource.\nThe attack flow begins with an adversary obtaining a target {imageId}. This identifier can be retrieved via out-of-band reconnaissance, such as scraping public front-end metadata, sniffing network traffic, or leveraging leaked internal logs.\nUpon acquiring the {imageId}, the attacker executes an unauthenticated GET request to /api/image/{imageId}/comments. The server, lacking an authorization guard clause, retrieves the full comment thread from the backend database and transmits the serialized data back to the unauthenticated client.\nBeyond static retrieval, the vulnerability extends to server-sent-events (SSE). An attacker may establish a persistent connection to the SSE subscription endpoint for the same {imageId}. Because the backend fails to check for an active, authorized session, the application maintains the connection and broadcasts live updates of new comments to the unauthenticated attacker's client in real-time.\nThe exposure is network-based; any actor capable of reaching the Slink API can initiate these unauthorized calls. There is no payload complexity involved, as the exploit relies on standard HTTP(S) protocol interactions and protocol-compliant SSE connection requests.\nThe impact of successful exploitation is total loss of confidentiality regarding user discussions on images. This facilitates privacy violations, sensitive information leakage, and potential long-term surveillance of image threads by unauthorized third parties.\nThe vulnerability is inherent to the API routing and controller logic where security filters are bypassed or entirely absent for comment-related API actions, rendering the entire comment infrastructure accessible to the public internet regardless of the intended access policies."
}