PT-2026-118454 · Sharkord · Sharkord
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sharkord