An authenticated missing-authorization flaw exists in the others.changeLogo tRPC mutation in Sharkord before 0.0.26. The route allows any logged-in user, even those without the MANAGE_SETTINGS permission, to replace the server’s logo with an uploaded image. This gives an attacker the ability to alter the visual brand presented to all connected clients, potentially facilitating spoofing or brand abuse. The flaw does not provide remote code execution but enables unauthorized configuration changes.

The vulnerability affects the Sharkord application distributed under the product name Sharkord. All releases prior to version 0.0.26, including v0.0.25 and earlier, are impacted. The affected component is the others.changeLogo tRPC route located in the server codebase. No specific operating system or platform is mentioned; the issue is confined to the application level.

The CVSS score is 5.3, indicating a moderate security impact. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers require only authentication to the application – any user with a valid login can exploit the route. The exploitation path is straightforward: an attacker chooses an image, sends a mutation to the changeLogo endpoint, and the server updates the logo for all connected clients. Because no special privileges are required beyond being logged in, the likelihood of exploitation is moderate in environments where many users have access. Users with elevated roles are advised to patch promptly to remove this privilege escalation vector.