CVE-2026-53634 json
Sharp: Missing Authorization Check in Quick Creation Command Endpoints
published 5mo ago modified 3mo ago also EUVD-2026-36117 , GHSA-vmwx-m75v-qvch
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3.
Patch / fix
- packagist code16/sharp 9.22.3
- code16 sharp 9.22.3
- github.com/code16/sharp@aa18a85 commit
- github.com/code16/sharp#729 pull request
- github.com/code16/sharp/releases/tag/v9.22.3 release
Is CVE-2026-53634 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | code16/sharp | >=9.0.0, <9.22.3 |
9.22.3 |
Affected products
- code16 sharp
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/code16/sharp/pull/729
web
-
github.com
/code16/sharp/commit/aa18a85fd8fef830988a336cad2278986729d21a
web
-
github.com
/code16/sharp/security/advisories/GHSA-vmwx-m75v-qvch
web
-
github.com
/code16/sharp/releases/tag/v9.22.3
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-53634
advisory
-
github.com
/code16/sharp
package
Sources
- CVE List CVE-2026-53634
- GitHub Advisory GHSA-vmwx-m75v-qvch
- NVD CVE-2026-53634
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.