Live › vulnerability › CVE-2026-113594
Go to dashboardSharkord before 0.0.8 lets any authenticated member call the others.updateSettings tRPC mutation without holding the MANAGE_SETTINGS permission. An attacker can set a join password, disable registration, zero upload limits, or toggle plugin loading, which denies service to other members.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Sharkord server running a version before 0.0.8 that has regular authenticated members beyond the admins. Single-user or admin-only servers have little exposure because the attacker must already hold a member account.
No product ranges from the sources yet.
sharkord --version or the package.json of the deployed build, and confirm whether it is below 0.0.80.0.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.
This page as .md · .json · in your agent: get_signal("CVE-2026-113594")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.