An authenticated user can submit new records or retrieve creation forms without having the required create permission on a Sharp entity. The vulnerability arises because the Quick Creation Command feature does not enforce an authorization check on the create and store endpoints in versions earlier than 9.22.3. This allows an attacker who already authenticates to the system to bypass normal permission controls and create or view data for entities they should not have access to, compromising data integrity and potentially confidentiality.

The issue affects the Sharp content management framework for Laravel, version 9.0.0 through 9.22.2 inclusive, provided by the vendor code16. Any deployment using these versions without the Update to v9.22.3 is vulnerable.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring an authenticated Sharp user who lacks create permissions. Success requires that a Quick Creation Command handler be configured for the target entity. While the flaw does not allow remote code execution or privilege escalation beyond the existing authenticated user, it enables unauthorized data manipulation at a moderate risk level.