CVE-2026-113594 in Sharkord
Summary
by MITRE • 10/20/2026
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The identified security flaw in Sharkord versions prior to 0.0.8 represents a critical failure in server-side access control mechanisms, specifically categorized under CWE-269 Improper Privilege Management. This vulnerability arises from an insufficient authorization check within the tRPC mutation endpoint responsible for updating global configuration settings. While the application correctly verifies that a user is authenticated and holds some level of membership status, it fails to validate whether that specific member possesses the requisite MANAGE_SETTINGS permission required to alter server-wide parameters. Consequently, any registered user with basic access rights can bypass administrative restrictions by directly invoking the others.updateSettings mutation, effectively elevating their privileges beyond what was intended by the system architecture.
The operational impact of this vulnerability is severe and multifaceted, allowing malicious actors or disgruntled members to disrupt service availability and compromise server integrity. By exploiting this flaw, an attacker can enforce a join password on the server, thereby locking out new users who do not possess the credential they arbitrarily set. Furthermore, the ability to disable user registration prevents future growth and isolates existing communities from potential new participants. The vulnerability also permits the setting of zero upload limits, which effectively halts all media sharing functionality within the application, rendering core features unusable for legitimate users. Additionally, toggling plugin loading states can break dependent functionalities or introduce instability if incompatible plugins are forced into an active state without proper validation.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1484 Domain Policy Modification, as it involves altering configuration settings that govern user access and system behavior. It also reflects aspects of Denial of Service (DoS) through resource exhaustion or feature disablement, corresponding to techniques such as T1529 System Shutdown or Reboot if the attacker chooses to crash services via misconfiguration, though in this case, it is more accurately described as functional disruption via configuration abuse. The lack of granular permission checks highlights a common architectural oversight where business logic assumes that authentication implies sufficient authorization for all actions available within an authenticated session scope.
To mitigate this vulnerability, immediate patching to version 0.0.8 or later is required, as the developer has addressed these access control gaps in subsequent releases. In environments where upgrading is not immediately feasible, administrators should implement network-level controls such as Web Application Firewalls (WAF) rules that restrict direct invocation of tRPC mutations for non-administrative IP addresses or user roles if possible through reverse proxy configurations. Additionally, conducting a thorough audit of all API endpoints to ensure consistent enforcement of role-based access control policies is recommended to prevent similar privilege escalation flaws in other parts of the application. Regular security testing focused on broken object level authorization and improper privilege management will help identify such gaps before they can be exploited by malicious actors seeking to disrupt service or gain unauthorized administrative influence.