A missing authorization check on Slink’s image comment endpoints allows an attacker who knows an image identifier to retrieve the entire comment thread via a simple GET request, and to subscribe to live comment updates over server‑sent‑events. The vulnerability does not grant execution or modification rights, but it does expose potentially sensitive discussion data and allows observation of user interactions in real time. The impact is primarily on confidentiality, as the attacker can view comments that may contain personal or sensitive information about image owners or collaborators.

Vendors A. Kryvoviaz’s Slink application, any deployment that includes a version earlier than 1.12.3. No specific patch version details are listed beyond the release of v1.12.3, which is stated to address the issue.

The CVSS score of 6.9 indicates a medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need the image identifier, which can be obtained out of band, and would access the vulnerability over the network through the public API. The absence of authentication or authorization checks makes exploitation straightforward for anyone who can reach the API endpoints.