Vulnerability DatabaseCVE-2026-113595
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-113595
Published:October 20, 2026
Updated:November 14, 2026
Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is published to every connected client.
Affected Packages
https://github.com/Sharkord/sharkord.git (GITHUB):
Affected version(s) >=v0.0.1 <v0.0.26
Fix Suggestion:
Update to version v0.0.26
Related Resources (9)
https://www.vulncheck.com/advisories/sharkord-before-0.0.26-missing-authorization-via-changelogo-trpc-route
https://github.com/Sharkord/sharkord
https://github.com/Sharkord/sharkord/releases/tag/v0.0.26
https://github.com/Sharkord/sharkord/commit/fd15061eaf366c7150325780a2d7b4b452f1134f
https://github.com/Sharkord/sharkord/blob/v0.0.25/apps/server/src/routers/others/change-logo.ts
https://github.com/Sharkord/sharkord/issues/387
https://nvd.nist.gov/vuln/detail/CVE-2026-113595
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113595.json
https://github.com/Sharkord/sharkord/issues/851
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Missing Authorization
CWE-862
EPSS
Base Score:
0.32