CVE-2026-113595

Deferred Deferred - Pending Action

Sharkord Missing Authorization Logo Change Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: VulnCheck

Description

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is published to every connected client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113595

EUVD

EUVD-2026-105161

Affected Vendors & Products

Vendor	Product	Version / Range
Sharkord	sharkord	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Sharkord before version 0.0.26 has a missing authorization vulnerability in the changeLogo tRPC mutation. This flaw allows any authenticated user, even without the MANAGE_SETTINGS permission, to modify or remove the server logo and replace it with an uploaded image. The change is then published to all connected clients.

Detection Guidance

Check Sharkord server logs for unauthorized logo changes or tRPC mutation calls to the changeLogo route. Inspect network traffic for POST requests to /trpc/others.changeLogo without MANAGE_SETTINGS permission checks. Verify server files for unexpected logo image modifications in the Sharkord assets directory.

Impact Analysis

An attacker could replace the server logo with malicious content, potentially misleading users or damaging the server's reputation. Since the change affects all connected clients, it could spread unwanted or harmful images across the platform.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to modify server settings, including logos. Unauthorized changes to server configurations may violate data integrity and access control requirements under these regulations.

Mitigation Strategies

Update Sharkord to version 0.0.26 or later to apply the permission check fix. Review server logs for past unauthorized logo changes and remove any malicious images. Ensure all users have appropriate permissions and restrict MANAGE_SETTINGS to authorized personnel only.

Hi! I’m here to help you understand CVE-2026-113595. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...