Sharp CMS CVE-2026-53634

The attacker must hold a valid authenticated Sharp session (PR:L from CVSS - unauthenticated exploitation is not possible). The targeted entity must have a Quick Creation Command handler explicitly configured via configureQuickCreationForm() in its entity list class - this is an opt-in, non-default feature that must be deliberately enabled per entity by the application developer. The attacker's Sharp role must lack 'create' permission on that entity (if the user already has create permission, no bypass is needed). Exploitation is constrained to unauthorized record creation only; there is no associated read, update, or delete bypass, and no confidentiality exposure. Entities without a Quick Creation Command handler configured are fully unaffected, as are all other command types and standard CRUD endpoints.

The CVSS base score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects a constrained but exploitable bypass. Exploitation requires a valid Sharp session (PR:L), which limits the attack surface to internal or authenticated application users rather than anonymous internet-sourced threats. The integrity impact is bounded to unauthorized record creation - there is no confidentiality bypass (C:N) and no availability impact (A:N), which materially reduces real-world blast radius compared to typical authorization-bypass findings. No EPSS score was included in the provided input data; exploitation probability is inferred as low-to-moderate given the authentication prerequisite and narrow impact. The vulnerability is not listed in CISA KEV and no public POC has been identified, consistent with a low-urgency finding absent active targeting. Risk is elevated specifically in multi-tenant Sharp deployments where role separation for create permissions is a security boundary - in such environments, a malicious or compromised low-privilege user could populate entities with fraudulent records. For single-role deployments, the practical impact is negligible.

An authenticated Sharp user with a role that prohibits create access on, for example, a 'Person' entity inspects the application's JavaScript bundle or API documentation and identifies the Quick Creation Command route pattern. The user directly issues a GET request to the quick-creation-form endpoint with their valid session cookie to retrieve the creation form, then a POST request to submit a new Person record - both succeed without a 403 response because the controller never invokes the authorization check. No public POC is available, but the technique is trivially discoverable by any authenticated user with basic HTTP inspection skills.