Description
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Sharkord sharkord
Default version status: unaffected
0 to < 0.0.8affected
References
- https://github.com/Sharkord/sharkord/issues/387 ↗
- https://github.com/Sharkord/sharkord/commit/3866cd3a352e99ddedbd9f809261dacaca4d2c29 ↗
- https://github.com/Sharkord/sharkord/releases/tag/v0.0.8 ↗
- https://github.com/Sharkord/sharkord/blob/v0.0.7/apps/server/src/routers/others/update-settings.ts ↗
- https://www.vulncheck.com/advisories/sharkord-before-0.0.8-missing-authorization-via-updatesettings-trpc-route ↗