CVE-2026-18737

This is a SQL injection vulnerability in Shlink's API where the ORDER BY direction parameter is passed unsanitized to Doctrine's query builder. The attacker supplies a value like '1) UNION SELECT...' to extract data from other tenants — this isn't just injection, it's a complete tenant isolation bypass available to any authenticated API key holder. The root cause is a documented ORM limitation: WHERE clause values can be parameterized safely, but column names and ORDER BY direction tokens cannot. Developers must either use an allowlist or build the clause dynamically. In this case, neither happened — the direction field was assumed to only ever receive 'ASC' or 'DESC', and that mental model replaced actual validation. The authentication requirement creates a dangerous false confidence. A compromised or stolen API key grants not just access to the holder's own data, but the ability to extract every other tenant's long URLs, visitor records, and API key hashes. This is a row-level tenant isolation failure at the query layer — the application is checking authentication but not whether the authenticated principal should access the requested tenant's data. The fix requires two things: first, add explicit allowlist validation on the direction parameter (in_array against ['ASC', 'DESC'] is sufficient for the symptom). Second, audit every QueryBuilder::orderBy() call in the codebase — if one endpoint has this pattern, others likely do. The narrow patch is incomplete if it doesn't trigger a broader code review of dynamic query construction throughout the application. ORMs do not protect against SQL injection in ORDER BY clauses; this limitation must be addressed at the application layer on every query.

Reviewed through automated stages and approved by a human before publication.