Sharkord
Monthly
Sharkord before 0.0.26 allows any authenticated server member to replace or remove the server logo without MANAGE_SETTINGS permission because the others.changeLogo tRPC mutation omits its permission check. The impact is limited to integrity of a server setting: the changed logo is published to every connected client, but there is no confidentiality or availability impact and the attacker must already hold a valid low-privilege account. No public exploit code was identified at time of analysis, and a vendor-released fix is available in Sharkord 0.0.26.
Missing authorization in Sharkord versions before 0.0.8 allows any authenticated member to call the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission, enabling tampering with server-wide configuration such as join passwords, registration toggles, upload limits, and plugin loading. The issue affects default deployments because the vulnerable code path simply omits the permission check, though exploitation requires a valid member account and is therefore limited to authenticated users rather than unauthenticated outsiders. At the time of analysis, no public exploit code was identified, and the vendor has released a patch in version 0.0.8.
Sharkord before 0.0.26 allows any authenticated server member to replace or remove the server logo without MANAGE_SETTINGS permission because the others.changeLogo tRPC mutation omits its permission check. The impact is limited to integrity of a server setting: the changed logo is published to every connected client, but there is no confidentiality or availability impact and the attacker must already hold a valid low-privilege account. No public exploit code was identified at time of analysis, and a vendor-released fix is available in Sharkord 0.0.26.
Missing authorization in Sharkord versions before 0.0.8 allows any authenticated member to call the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission, enabling tampering with server-wide configuration such as join passwords, registration toggles, upload limits, and plugin loading. The issue affects default deployments because the vulnerable code path simply omits the permission check, though exploitation requires a valid member account and is therefore limited to authenticated users rather than unauthenticated outsiders. At the time of analysis, no public exploit code was identified, and the vendor has released a patch in version 0.0.8.