Missing Authorization in Sharkord Allows Unauthorized Logo Changes
CVE-2026-113595

5.3MEDIUM

Key Information:

Vendor

Sharkord

Status
Sharkord
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113595?

Sharkord versions prior to 0.0.26 contain a vulnerability that allows any authenticated user to change the server logo via the others.changeLogo tRPC mutation, even without the necessary MANAGE_SETTINGS permission. This exploit enables unauthorized alteration of the logo, potentially leading to misleading branding or phishing attacks, as the change affects all connected clients instantly. Users are advised to update to version 0.0.26 or later to mitigate this risk.

Affected Version(s)

sharkord 0 < 0.0.26

References

https://github.com/Sharkord/sharkord/issues/387
issue-tracking
https://github.com/Sharkord/sharkord/issues/851
issue-tracking
https://github.com/Sharkord/sharkord/commit/fd15061eaf366...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
Marek-Romanski
leediay153 from Viettel Post
.