CVE-2026-113595: Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route
Published Oct 20, 2026
·Updated
Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is published to every connected client.
Affected Software
1 affected component
Sharkord Sharkord<0.0.26
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sharkordto a version that resolves this vulnerability.Fixed in 0.0.26
Event History
Oct 20, 2026
CVE Published
via MITRE·03:40 PM
Data Sourced
via MITRE·03:40 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which versions require remediation?
Sharkord versions before 0.0.26 are affected. Version 0.0.26 is the first version identified as not affected.
2
What access does an attacker need?
An attacker must be authenticated as a Sharkord member. They do not need the MANAGE_SETTINGS permission.