{"id":"CVE-2026-113594","published":"2026-10-20T16:17:07.920","lastModified":"2026-10-20T20:11:29.833","description":"Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Sharkord/sharkord/blob/v0.0.7/apps/server/src/routers/others/update-settings.ts","tags":[]},{"url":"https://github.com/Sharkord/sharkord/commit/3866cd3a352e99ddedbd9f809261dacaca4d2c29","tags":[]},{"url":"https://github.com/Sharkord/sharkord/issues/387","tags":[]},{"url":"https://github.com/Sharkord/sharkord/releases/tag/v0.0.8","tags":[]},{"url":"https://www.vulncheck.com/advisories/sharkord-before-0.0.8-missing-authorization-via-updatesettings-trpc-route","tags":[]}],"exploitRefs":[{"url":"https://github.com/Sharkord/sharkord/blob/v0.0.7/apps/server/src/routers/others/update-settings.ts","tags":[]},{"url":"https://github.com/Sharkord/sharkord/commit/3866cd3a352e99ddedbd9f809261dacaca4d2c29","tags":[]},{"url":"https://github.com/Sharkord/sharkord/issues/387","tags":[]},{"url":"https://github.com/Sharkord/sharkord/releases/tag/v0.0.8","tags":[]}],"hasPoc":true,"ai":null}