EUVD-2026-110514

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a...

CVE-2026-116806

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a...

OpenPanel permission and access control issues vulnerability

Versions prior to OpenPanel 3.0.0 contain a permission and access control vulnerability stemming from an absence of authorization in onboarding.project’s tRPC mutation. This flaw enables non-administrator organizational members to create projects and generate writeable ingestion credentials,...

CVE-2026-116806 OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a...

CVE-2026-116806 OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a...

CVE-2026-116806

OpenPanel versions prior to 3.0.0 are susceptible to a missing authorization vulnerability within the onboarding.project tRPC mutation. This flaw allows non-admin organization members to bypass admin-only policies to create projects and mint write-type ingestion credentials . An attacker using a ...

PT-2026-125512

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a...

CVE-2026-113594

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...

CVE-2026-113595 Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...

CVE-2026-113595

Sharkord versions prior to 0.0.26 are vulnerable to a missing authorization flaw in the others.changeLogo tRPC mutation. This vulnerability allows any authenticated member to modify the server logo without possessing the required MANAGE_SETTINGS permission. An attacker can exploit this to remove ...

CVE-2026-113595 Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...

CVE-2026-113595 Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...

EUVD-2026-105161

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...

CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...

CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...

CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...

CVE-2026-113594

Sharkord versions before 0.0.8 are vulnerable to a missing authorization flaw in the others.updateSettings tRPC mutation. This allows any authenticated member to modify server-wide settings without the required MANAGE_SETTINGS permission. Exploitation can lead to a denial of service by allowing a...

EUVD-2026-105160

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...

PT-2026-118454

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE SETTINGS permission. Attackers can set a join password, disable registration, zero upload...

Sharkord authorization issue vulnerability

Versions of Sharkord prior to 0.0.26 have a vulnerability related to authorization. This vulnerability stems from the lack of authorization verification in the others.changeLogo tRPC mutation. As a result, any authenticated member can modify the server’s logo without having the MANAGESETTINGS...