Read the docs
TI-2026-76923 Aliases CVE-2026-113594GHSA-p2rv-36r3-pvw3

Missing authorization in Sharkord settings update route

Priority LOW 24CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Sharkord before 0.0.8 contains a missing authorization flaw (CWE-862) in the others.updateSettings tRPC mutation. Any authenticated member can change server-wide settings without the MANAGE_SETTINGS permission. An attacker can set a join password, disable registration, zero upload limits, or toggle plugin loading, which denies service to other members. The CVSS 4.0 vector requires low privileges and no user interaction over the network.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix Fixed sharkord (Sharkord): 0.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Sharkordsharkordbefore 0.0.80.0.8Patch availableCNA
  • sharkord VendorSharkord Affected before 0.0.8 Fixed in 0.0.8 Patch available CNA

Remediation

Upgrade sharkord to version 0.0.8.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA sharkord (Sharkord) Fixed in 0.0.8

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113594
  2. 2026-10-20 CISA SSVC decision points changed
  3. 2026-10-21 Alias added: GHSA-p2rv-36r3-pvw3

References

Patch 1

Other 3

  • TI-2026-76924 Missing authorization in Sharkord lets members change the server logo CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences