Read the docs
TI-2026-38678 Aliases CVE-2026-53634GHSA-vmwx-m75v-qvch

Sharp: Missing Authorization Check in Quick Creation Command Endpoints

Priority LOW 19CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix Fixed sharp (code16): 9.22.3code16/sharp (Packagist): 9.22.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
code16sharp9.0.0 to before 9.22.39.22.3Patch availableCNA
—code16/sharp (Packagist)9.0.0 to before 9.22.39.22.3Patch availableGHSA-vmwx-m75v-qvch
  • sharp Vendorcode16 Affected 9.0.0 to before 9.22.3 Fixed in 9.22.3 Patch available CNA
  • code16/sharp (Packagist) Vendor— Affected 9.0.0 to before 9.22.3 Fixed in 9.22.3 Patch available GHSA-vmwx-m75v-qvch

Remediation

  • Fix · CNA sharp (code16) Fixed in 9.22.3
  • Fix · GHSA-vmwx-m75v-qvch code16/sharp (Packagist) Fixed in 9.22.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53634
  2. 2026-10-03 Alias added: GHSA-vmwx-m75v-qvch

References

Advisory 1

Other 5

  • TI-2026-26067 Sharp has Unrestricted File Upload via Client-Controlled Validation Rules CVSS 3.1HIGH 8.8
  • TI-2026-26066 Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil CVSS 3.1HIGH 8.8
  • TI-2026-44250 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass CVSS 3.1HIGH 8.7
  • TI-2026-44248 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute CVSS 3.1HIGH 7.3
  • TI-2026-32583 Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint CVSS 3.1HIGH 7.7
  • TI-2025-38981 Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences