The vulnerability originates from the others.updateSettings tRPC mutation, which lacks proper authorization checks. Any authenticated member can invoke this route to modify global server settings such as the join password, registration toggle, upload limits, and plugin activation. The absence of the MANAGE_SETTINGS permission allows the user to forcibly alter critical configuration, potentially denying service to legitimate users.

Affected installations are Sharkord servers running any version prior to 0.0.8, including 0.0.7 and earlier. The vulnerability is present downstream of the update-settings route in the server source. Only deployments that have not applied the 0.0.8 release upgrade are impacted.

The CVSS score of 5.3 places the flaw in the medium severity range, and no EPSS value is available, but the lack of a KEV listing indicates no widespread exploitation is currently known. However, because the attack requires an authenticated session, exposure is limited to users who have logged in, and compromised credentials could lead to a denial‑of‑service or misconfiguration. Remediation is straightforward through the official patch.