CVE-2026-113595

MediumCVSS 4.3

Published: 20/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is published to every connected client.

Risk Assessment

Integrity breach — unauthorized change of the server logo can lead to defacement and mislead users. This may harm reputation and trust in the platform.

Recommendation

Update Sharkord to version 0.0.26 or later. Additionally, consider verifying permissions for tRPC mutations related to server settings.

Other vulnerabilities in Sharkord

CVE-2026-113594Medium
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS