CVE-2026-50887

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent, geolocation, and full short URL objects for URLs outside their authorization boundary.

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability. An unauthenticated attacker can send a single request to any short URL, supplying malicious values in User-Agent, Referer, or request path headers that begin with formula-triggering characters (=, +, -, @). When the exported visit data CSV is opened in a spreadsheet application, DDE or WEBSERVICE formulas are executed on the administrator's client machine.

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments via an unvalidated direction value in the orderBy parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flow unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets.

Shlink contains a server-side request forgery (SSRF) vulnerability that allows authenticated API key holders to force the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can use URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information.