Missing Authorization Vulnerability in Shaark API Controllers
CVE-2026-109568

7.1HIGH

Key Information:

Vendor

Marceauka

Status
Shaark
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109568?

Shaark versions 1.2.13 to 1.2.44 exhibit a vulnerability that allows authenticated non-admin users to bypass ownership checks in the API controllers for Link, Story, Chest, and Album. This weakness can be exploited by sending PUT or DELETE requests to specific endpoints with numeric IDs, enabling attackers to overwrite or delete content belonging to other users, including private items. Securing these endpoints is crucial to preventing unauthorized access and potential data loss.

Affected Version(s)

Shaark 1.2.13 <= 1.2.44

References

https://github.com/MarceauKa/shaark/pull/110
issue-trackingpatch
https://github.com/MarceauKa/shaark/blob/1.2.44/app/Http/...
technical-description
https://github.com/MarceauKa/shaark
product

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ismail özdoğan
saaa99999999
.