CVE-2026-53634 Details
Description
Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3.
A vulnerability exists in Code16 Sharp, a Laravel-based content management framework, in versions 9.0.0 prior to 9.22.3. The issue arises in the Quick Creation Command feature, where the create and store endpoints lack proper authorization checks. This flaw allows authenticated users to bypass authorization and either access the creation form or submit new records for an entity, provided a Quick Creation Command handler is active for that entity.
Users should upgrade to Sharp version 9.22.3 or later, and can remove or disable Quick Creation Command handlers on affected entity lists until the upgrade is complete.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/code16/sharp/commit/aa18a85fd8fef830988a336cad2278986729d21a | [email protected] | Source CodeVendor |
| https://github.com/code16/sharp/pull/729 | [email protected] | Issue TrackingVendor |
| https://github.com/code16/sharp/releases/tag/v9.22.3 | [email protected] | Release NotesVendor |
| https://github.com/code16/sharp/security/advisories/GHSA-vmwx-m75v-qvch | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| code16 Sharp | >= 9.0.0, < 9.22.3 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |