PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113595 Sharkord CVE debrief

CVE-2026-113595 is a missing authorization vulnerability in Sharkord before version 0.0.26. The vulnerability exists in the others.changeLogo tRPC mutation, allowing any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. This could potentially allow attackers to remove the current logo and replace it with an uploaded image that is published to every connected client.

Vendor
Sharkord
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-23
Advisory published
2026-10-20
Advisory updated
2026-10-23

Who should care

Sharkord administrators and developers should verify and apply the patch to prevent unauthorized changes to the server logo. They should review the current version, assess permissions, and ensure that only authorized members can modify the server logo. Additionally, they should monitor for any suspicious changes to the server logo and adjust permissions as needed.

Why it matters

CVE-2026-113595 is a medium-severity vulnerability in Sharkord before version 0.0.26 that allows authenticated members to change the server logo without proper authorization. This could lead to unauthorized changes to the logo displayed to connected clients. Administrators and developers should verify the current version, review permissions, and apply the patch in version 0.0.26 or later.

  • Potential unauthorized changes to the server logo.
  • Verification of permissions and access controls is necessary.
  • Upgrade to version 0.0.26 or later to apply the fix.

Technical summary

The vulnerability exists in the others.changeLogo tRPC mutation in Sharkord before version 0.0.26. Any authenticated member can modify the server logo without the MANAGE_SETTINGS permission, potentially allowing attackers to change the logo to an uploaded image. This could lead to unauthorized changes to the logo displayed to connected clients. The fix is included in version 0.0.26, which addresses the missing authorization issue. Sharkord administrators and developers should review the current version, assess permissions, and apply the patch.

Defensive priority

Medium priority for Sharkord administrators and developers to verify and apply the patch.

Recommended defensive actions

  • Verify the current version of Sharkord and upgrade to 0.0.26 or later if necessary.
  • Review and adjust permissions for authenticated members to prevent unauthorized changes.
  • Monitor for any suspicious changes to the server logo.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was reported by an external source and verified by the Sharkord team. The fix is included in version 0.0.26. Evidence limits suggest that further verification may be required to confirm affected scope and severity. Defenders should review the official advisory and verify system configurations to ensure they are not exposed.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113595 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113595

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113595 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113595

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113595.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Sharkord/sharkord/issues/387

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Sharkord/sharkord/issues/851

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Sharkord/sharkord/commit/fd15061eaf366c7150325780a2d7b4b452f1134f

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Sharkord/sharkord/releases/tag/v0.0.26

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Sharkord/sharkord/blob/v0.0.25/apps/server/src/routers/others/change-logo.ts

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/sharkord-before-0.0.26-missing-authorization-via-changelogo-trpc-route

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.