{"id":"CVE-2026-53634","aliases":["GHSA-vmwx-m75v-qvch"],"title":"Sharp Missing Authorization Check in Quick Creation Command Endpoints","summary":"Sharp Missing Authorization Check in Quick Creation Command Endpoints","severity":"medium","cvss":4.3,"cwe":["CWE-862"],"vendor":"code16","product":"code16/sharp","ecosystem":"composer","affected":["code16/sharp >= 9.0.0, < 9.22.3"],"patched":["code16/sharp 9.22.3"],"published":"2026-07-08","updated":"2026-07-08","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-vmwx-m75v-qvch","references":[{"url":"https://github.com/code16/sharp/security/advisories/GHSA-vmwx-m75v-qvch"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53634"},{"url":"https://github.com/code16/sharp/pull/729"},{"url":"https://github.com/code16/sharp/commit/aa18a85fd8fef830988a336cad2278986729d21a"},{"url":"https://github.com/code16/sharp/releases/tag/v9.22.3"},{"url":"https://github.com/advisories/GHSA-vmwx-m75v-qvch"}],"tags":["ghsa","composer"],"epss":0.00213,"epssPercentile":0.11942,"ingestedAt":"2026-07-08T20:46:41.625Z","slug":"CVE-2026-53634","body":"## Overview\n\n### Impact\nThe create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured.\n\n### Patches\nYes. The fix is included in version 9.22.3. Users should upgrade to that version or later.\n\n### Workarounds\nRemove or disable Quick Creation Command handlers (quickCreationCommandHandler()) on any entity list where unauthorized access is a concern, until an upgrade is possible.\n\n### Resources\n[PR #729](https://github.com/code16/sharp/pull/729)\n\n## Affected packages\n\n- `code16/sharp >= 9.0.0, < 9.22.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `code16/sharp 9.22.3`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}