CVE-2026-53634: Sharp: Missing Authorization Check in Quick Creation Command Endpoints
Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured.
Patches Yes. The fix is included in version 9.22.3. Users should upgrade to that version or later.
Workarounds Remove or disable Quick Creation Command handlers (quickCreationCommandHandler()) on any entity list where unauthorized access is a concern, until an upgrade is possible.
Resources PR #729
Other sources
Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/code16/sharpto a version that resolves this vulnerability.Fixed in 9.22.3 - Upgrade
Upgrade
Sharpto a version that resolves this vulnerability.Fixed in 9.22.3 - Configuration
Remove or disable the Quick Creation Command handlers (quickCreationCommandHandler()) on any entity list where unauthorized access is a concern, until an upgrade is possible.
Sharp Quick Creation Command handlers (quickCreationCommandHandler()) Enable/disable quickCreationCommandHandler() on entity lists = disable
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53634?
The severity of CVE-2026-53634 is medium with a score of 4.3.
How do I fix CVE-2026-53634?
To fix CVE-2026-53634, upgrade your Sharp package to version 9.22.3 or later.
What impact does CVE-2026-53634 have on Sharp?
CVE-2026-53634 allows an authenticated user to create entities without proper authorization checks.
Which versions of Sharp are affected by CVE-2026-53634?
CVE-2026-53634 affects Sharp versions from 9.0.0 to before 9.22.3.
What type of vulnerability is CVE-2026-53634?
CVE-2026-53634 is a missing authorization check vulnerability in Quick Creation Command endpoints of Sharp.