Sharkord CVE-2026-113594

Requires an authenticated member account on a Sharkord server running a version before 0.0.8 (PR:L); the attacker then calls the others.updateSettings tRPC mutation, which in the vulnerable code path omits the MANAGE_SETTINGS permission check entirely, so no special server configuration is needed and it works against default deployments. Exploitation is LIMITED by the need for a valid member login - it is not reachable by fully unauthenticated outsiders - and by the fact that impact is restricted to server-wide settings tampering (join password, registration toggle, upload limits, plugin loading) rather than data disclosure or code execution. The practical exposure rises sharply on instances that allow open/self-service registration, since any such account satisfies the only precondition.

This is a genuine but moderate-severity authorization flaw, not a critical priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and is internally consistent with the description: it requires an authenticated low-privileged account (PR:L), needs no user interaction, and yields only integrity (VC:N/VI:L) and availability (VA:L) impact with no confidentiality loss and no scope change - matching a member tampering with server settings to degrade service rather than stealing data or achieving code execution. No EPSS score, CISA KEV listing, or SSVC decision point was supplied, so there is no evidence of active exploitation or automatability; per the input signals this is 'no public exploit identified at time of analysis.' The main thing limiting real-world risk is the PR:L requirement - the attacker must already be a logged-in member of the target server - so impact is confined to insiders or anyone who can obtain a member account on an open-registration instance. Overall this is a correctly-rated MEDIUM: real and worth patching (vendor fix exists), but not a drop-everything issue absent any exploitation telemetry.

A low-privileged member of a self-hosted Sharkord server (for example, someone who joined via open registration) issues the others.updateSettings tRPC mutation directly, which in versions before 0.0.8 never checks for the MANAGE_SETTINGS permission. The attacker sets a server join password, disables new registration, zeroes upload limits, or toggles plugin loading, denying service and locking out other members. No public exploit code was identified, but the one-call nature of the flaw makes it trivial to reproduce for any authenticated user.