CVE-2026-53634
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Sharp, a Laravel content management framework, from version 9.0.0 to before 9.22.3 does not enforce authorization checks on the create and store endpoints of the Quick Creation Command feature. An authenticated Sharp user without create permission on a given entity can bypass authorization and create new records for that entity if a Quick Creation Command handler is configured.
Risk Assessment
Unauthorized users can create entities they should not have access to, potentially leading to data integrity breaches and unauthorized feature access.
Recommendation
Update Sharp to version 9.22.3 or later.
Other vulnerabilities in Sharp
See all- GHSA-f88m-g3jw-g9cjHigh
Several vulnerabilities have been discovered and fixed in the upstream libvips dependency, two rated as high severity using CVSSv4. Versions of sharp prior to 0.35.0 processing untrusted input are affected.
- CVE-2026-44692High
Sharp, a CMS framework for Laravel, prior to version 9.22.0 exposes a generic download endpoint that authorizes access only to the entity instance but reads the target disk and path from request parameters. An authenticated Sharp user who can view one valid record may use it as an authorization anchor to download unrelated objects from Laravel Storage disks.
Original NVD description (English source)
Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3.