CVE-2026-113595

MEDIUM 4.3

Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is published to every connected client.

CWE	CWE-862
Vendor	sharkord
Product	sharkord
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for sharkord sharkord

Be the first to know when new medium vulnerabilities affecting sharkord sharkord are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

Sharkord / sharkord

0 < 0.0.26

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Sharkord/sharkord/issues/387 github.com: https://github.com/Sharkord/sharkord/issues/851 github.com: https://github.com/Sharkord/sharkord/commit/fd15061eaf366c7150325780a2d7b4b452f1134f github.com: https://github.com/Sharkord/sharkord/releases/tag/v0.0.26 github.com: https://github.com/Sharkord/sharkord/blob/v0.0.25/apps/server/src/routers/others/change-logo.ts vulncheck.com: https://www.vulncheck.com/advisories/sharkord-before-0.0.26-missing-authorization-via-changelogo-trpc-route

Credits

lighthousekeeper1212 Marek-Romanski 🔍 leediay153 from Viettel Post