Feed/CVE-2026-53634
CVE-2026-53634MEDIUMCVSS 4.3

Sharp Missing Authorization Check in Quick Creation Command Endpoints

Published Jul 8, 2026·Updated Jul 8, 2026

NVD Description

### Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. ### Patches Yes. The fix is included in version 9.22.3. Users should upgrade to that version or later. ### Workarounds Remove or disable Quick Creation Command handlers (quickCreationCommandHandler()) on any entity list where unauthorized access is a concern, until an upgrade is possible. ### Resources [PR #729](https://github.com/code16/sharp/pull/729)

Affected Packages (1)

code16/sharpCOMPOSER
From 9.0.0
Fixed in 9.22.3

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free