CVE-2026-113594: Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route

Q: Who can exploit this vulnerability?

Any authenticated Sharkord member can exploit it; the attacker does not need the MANAGE_SETTINGS permission. The affected route is the others.updateSettings tRPC mutation.

Q: Which deployments are affected?

Sharkord versions before 0.0.8 are affected. The issue is reachable over the network by a low-privileged authenticated member, so deployments that allow member accounts are exposed.

Q: What can an attacker change through the vulnerable route?

An attacker can modify server-wide settings, including setting a join password, disabling registration, setting upload limits to zero, or toggling plugin loading. These changes can deny service to other members.

Q: What should be done to remediate the issue?

Upgrade Sharkord to version 0.0.8 or later. If upgrading cannot happen immediately, limit access to authenticated member accounts and monitor or review server-wide settings for unauthorized changes.

Published Oct 20, 2026

Updated

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.

Affected Software

1 affected component

Sharkord Sharkord<0.0.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Sharkord to a version that resolves this vulnerability.
Fixed in 0.0.8

Event History

Oct 20, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

Any authenticated Sharkord member can exploit it; the attacker does not need the MANAGE_SETTINGS permission. The affected route is the others.updateSettings tRPC mutation.

Which deployments are affected?

Sharkord versions before 0.0.8 are affected. The issue is reachable over the network by a low-privileged authenticated member, so deployments that allow member accounts are exposed.

What can an attacker change through the vulnerable route?

An attacker can modify server-wide settings, including setting a join password, disabling registration, setting upload limits to zero, or toggling plugin loading. These changes can deny service to other members.

What should be done to remediate the issue?

Upgrade Sharkord to version 0.0.8 or later. If upgrading cannot happen immediately, limit access to authenticated member accounts and monitor or review server-wide settings for unauthorized changes.

CVE-2026-113594: Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which deployments are affected?

What can an attacker change through the vulnerable route?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which deployments are affected?

What can an attacker change through the vulnerable route?

What should be done to remediate the issue?