---
id: CVE-2026-53634
aliases:
  - GHSA-vmwx-m75v-qvch
title: Sharp Missing Authorization Check in Quick Creation Command Endpoints
summary: Sharp Missing Authorization Check in Quick Creation Command Endpoints
severity: medium
cvss: 4.3
cwe:
  - CWE-862
vendor: code16
product: code16/sharp
ecosystem: composer
affected:
  - 'code16/sharp >= 9.0.0, < 9.22.3'
patched:
  - code16/sharp 9.22.3
published: '2026-07-08'
updated: '2026-07-08'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-vmwx-m75v-qvch'
references:
  - url: 'https://github.com/code16/sharp/security/advisories/GHSA-vmwx-m75v-qvch'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53634'
  - url: 'https://github.com/code16/sharp/pull/729'
  - url: >-
      https://github.com/code16/sharp/commit/aa18a85fd8fef830988a336cad2278986729d21a
  - url: 'https://github.com/code16/sharp/releases/tag/v9.22.3'
  - url: 'https://github.com/advisories/GHSA-vmwx-m75v-qvch'
tags:
  - ghsa
  - composer
epss: 0.00366
epssPercentile: 0.27642
ingestedAt: '2026-07-08T20:46:41.625Z'
---

## Overview

### Impact
The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured.

### Patches
Yes. The fix is included in version 9.22.3. Users should upgrade to that version or later.

### Workarounds
Remove or disable Quick Creation Command handlers (quickCreationCommandHandler()) on any entity list where unauthorized access is a concern, until an upgrade is possible.

### Resources
[PR #729](https://github.com/code16/sharp/pull/729)

## Affected packages

- `code16/sharp >= 9.0.0, < 9.22.3`

## Remediation

Upgrade to a patched release:

- `code16/sharp 9.22.3`