Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission.
CVSS 4.0MEDIUM 5.3·Network·Low privileges·No interaction·EPSS 0.00317·Published 2026-10-20·Fixed in 0.0.26CWE-862
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS perm…
CVSS 4.0MEDIUM 5.3·Network·Low privileges·No interaction·EPSS 0.0034·Published 2026-10-20·Fixed in 0.0.8CWE-862