CyberRota Analysis
AI-GeneratedSlink versions prior to 1.12.3 are vulnerable due to improper authorization for image comment endpoints, enabling unauthenticated attackers to access comment threads through specific API calls. This flaw allows attackers to read and subscribe to live updates of comments on public images, potentially exposing sensitive user interactions. Organizations using Slink should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.