Threats tagged 'ghsa-r72g-8wq6-6m7w'

Shlink versions up to 5.1.6 have an authorization flaw where API key role restrictions are not properly enforced when issuing Mercure subscription tokens. This allows restricted API keys, such as author-only or domain-only keys, to subscribe to all topics and access visit data beyond their intended scope. The exposed data includes referrer, user agent, geolocation, and full short URL objects for URLs outside the authorized boundary.