CVE-2026-113595 Details
Description
Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is published to every connected client.
A missing authorization vulnerability has been identified in Sharkord versions prior to 0.0.26, specifically within the others.changeLogo tRPC mutation. This vulnerability allows any authenticated user to change the server logo without having the required MANAGE_SETTINGS permission. Exploitation of this issue enables users to remove the existing logo and replace it with an uploaded image, which is then displayed to all connected clients.
Users should update to Sharkord version 0.0.26 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Sharkord/sharkord/blob/v0.0.25/apps/server/src/routers/others/change-logo.ts | [email protected] | Source CodeVendor |
| https://github.com/Sharkord/sharkord/commit/fd15061eaf366c7150325780a2d7b4b452f1134f | [email protected] | Source CodeVendor |
| https://github.com/Sharkord/sharkord/issues/387 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Sharkord/sharkord/issues/851 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Sharkord/sharkord/releases/tag/v0.0.26 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/sharkord-before-0.0.26-missing-authorization-via-changelogo-trpc-route | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sharkord | >= 0, < 0.0.26 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |