---
id: "CVE-2026-113594"
kind: "vulnerability"
aliases: ["CVE-2026-113594"]
title: "Sharkord: any member can change server-wide settings without permission"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chat", "package", "self-hosted", "sharkord"]
not_affected_if: ["no-untrusted-members", "version-0.0.8-or-later"]
published_at: "2026-10-20T16:17:07+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:16:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113594", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Sharkord: any member can change server-wide settings without permission

Sharkord before 0.0.8 lets any authenticated member call the others.updateSettings tRPC mutation without holding the MANAGE_SETTINGS permission. An attacker can set a join password, disable registration, zero upload limits, or toggle plugin loading, which denies service to other members.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Sharkord version, for example with `sharkord --version` or the package.json of the deployed build, and confirm whether it is below `0.0.8`
- Review the server's settings in the admin UI for an unexpected join password, disabled registration, or zero upload limits

## Fix

- Upgrade Sharkord to `0.0.8` or later
- After upgrading, review server settings for changes made by non-admin members and restore expected values

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113594

## From the sources

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_