CVE-2026-85605

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...