CVE-2026-109568: Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs to overwrite or delete other users' content, including private items.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated non-admin Shaark user can exploit it. The attacker only needs a valid account and does not need administrator privileges or user interaction.
What access and requests are required to exploit it?
The attacker must send PUT or DELETE requests to the affected Link, Story, Chest, or Album API route and provide a numeric object ID. The affected routes are /api/{link,story,chest,album}/{id}.
What is the impact on private content?
An attacker can overwrite or delete content owned by other users, including private items. The reported impact is integrity loss and limited availability loss; no confidentiality impact is specified.
How can I tell whether my deployment is affected?
Deployments running Shaark versions 1.2.13 through 1.2.44 are affected. Review whether authenticated non-admin accounts can issue PUT or DELETE requests against the listed API routes using IDs belonging to other users.