CVE-2026-113594

Name of the Vulnerable Software and Affected Versions Sharkord versions prior to 0.0.8

Description An authorization flaw allows authenticated members to modify server-wide settings. This is possible by invoking the others.updateSettings tRPC mutation without possessing the MANAGE SETTINGS permission. An attacker can exploit this to set a join password, disable registration, set upload limits to zero, or toggle plugin loading, which can result in a denial of service for other members.

Recommendations Update Sharkord to version 0.0.8 or later.