CVE-2026-53634: falha de média gravidade em code16 sharp
Sharp: Missing Authorization Check in Quick Creation Command Endpoints
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.2%
Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
code16 · sharpCVEs relacionadas — code16 sharp
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33686HIGHSharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtilEPSS 0.6%CVE-2026-33687HIGHSharp has Unrestricted File Upload via Client-Controlled Validation RulesEPSS 0.5%CVE-2026-44692HIGHAuthenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpointEPSS 0.3%CVE-2026-61825HIGHcode16/sharp has a stored XSS via data-html-content Sanitizer BypassEPSS 0.2%CVE-2025-62798MEDIUMSharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntaxEPSS 0.2%CVE-2026-61823HIGHcode16 Sharp vulnerable to stored XSS via iframe srcdoc AttributeEPSS 0.2%