Sharkord EUVD-2026-105161

The attacker must be an authenticated member of a Sharkord server running a version before 0.0.26; no MANAGE_SETTINGS (admin/settings) permission is required because the others.changeLogo tRPC route omits the authorization check present on other settings operations. The exploitation is limited to the integrity of the server logo - the mutation only replaces the logo image broadcast to clients, with no file-system, data-confidentiality, or availability impact. Limiting factors: a valid low-privilege account on the target instance is required (PR:L), so fully unauthenticated attackers and non-members cannot exploit it; affected default behavior is present in v0.0.25 and earlier with no special non-default configuration needed.

This is a genuine but low-severity authorization flaw (CWE-862), not a high-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the CVSS 5.3 score agree that exploitation is network-reachable, low-complexity, and requires only low-privilege authentication (PR:L) with no user interaction - consistent with 'any authenticated member' in the description. The only impact is integrity-limited (VI:L); confidentiality and availability are explicitly rated None, matching the real-world effect (an unauthorized logo change broadcast to connected clients), so this is a defacement/integrity issue rather than a system-compromise vector. No EPSS score, no CISA KEV listing, and no public exploit code were provided; the source-code commit diff and a test case are available, which disclose the fix but do not constitute a weaponized exploit. There is no signal (KEV/EPSS/POC) suggesting active or widespread exploitation, so this reads as a legitimately fixed low-risk authorization bug rather than an urgent threat. Note: the input Tag 'Authentication Bypass' conflicts with the CWE-862 (missing authorization) classification and the description - this is missing authorization for an already-authenticated user, not an authentication bypass.

An authenticated low-privilege member of a Sharkord server (one without the MANAGE_SETTINGS permission) directly invokes the others.changeLogo tRPC mutation, which in v0.0.25 and earlier omits the permission check. The attacker removes the owner's logo and uploads a replacement image that is then published to every connected client, defacing the server for all members. No public exploit code was identified at time of analysis, though the patch commit and a regression test disclosing the vulnerable route are publicly available.