CVE-2026-113594
MediumCVSS 5.4Summary
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.
Risk Assessment
Availability and integrity breach — unauthorized settings changes can prevent other users from using the server (denial of service) and disrupt its operation. This may lead to downtime and loss of trust.
Recommendation
Update Sharkord to version 0.0.8 or later. In the meantime, consider restricting access to the others.updateSettings tRPC mutation.
Other vulnerabilities in Sharkord
Original NVD description (English source)
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS