CVE-2026-85605

Slink versions prior to 1.12.3 fail to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read full comment threads via GET /api/image/{imageId}/comments and subscribe to live updates via server-sent-events — provided they obtain an image ID out of band. T...