Auth‑bypass flaw in Shaark 1.2.13‑1.2.44 allows authenticated but non‑administrative users to perform PUT or DELETE requests on API endpoints for links, stories, chests, and albums. The ownership checks that are meant to prevent this action are omitted, so any user can target any numeric content ID, including private items, and overwrite or delete it. The result is a loss of confidentiality, integrity, and availability for the victim’s data.

The vulnerability affects Shaark installations compiled from versions 1.2.13 through 1.2.44. Users of authenticated accounts who do not have administrative privileges are impacted, as they can issue requests to the affected API routes. The flaw exists in the Link, Story, Chest, and Album controllers within the application code base.

The CVSS score of 7.1 classifies the issue as a high‑severity weakness that could be exploited by anyone who has logged in to the application. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers need only valid credentials and must be authenticated as a non‑admin user; no special network conditions are required, making the exploit feasible for many ordinary users who have access to the system.