Live › vulnerability › CVE-2026-113595
Go to dashboardSharkord before 0.0.26 exposes the others.changeLogo tRPC mutation without checking the MANAGE_SETTINGS permission. Any authenticated member can remove the server logo and upload a replacement that is shown to every connected client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Instances of Sharkord before 0.0.26 that have registered members other than trusted administrators. Exposure requires a valid account, so instances where every user is an administrator carry little added risk. Single-user or administrator-only deployments can skip it after checking the version.
No product ranges from the sources yet.
0.0.260.0.26 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is published to every connected client.
This page as .md · .json · in your agent: get_signal("CVE-2026-113595")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.