{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ashaarkshaark/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:shaark:shaark:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-109568"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Shaark (1.2.13 through 1.2.44)"],"_cs_severities":["high"],"_cs_tags":["web-application","authorization-bypass","api-security"],"_cs_type":"advisory","_cs_vendors":["Shaark"],"content_html":"\u003cp\u003eShaark versions 1.2.13 through 1.2.44 are affected by a missing authorization vulnerability within the Link, Story, Chest, and Album API controllers. The vulnerability stems from a failure to perform adequate ownership checks during API requests, which allows any authenticated, non-administrative user to interact with resources they do not own. By submitting crafted PUT or DELETE requests to the /api/link/{id}, /api/story/{id}, /api/chest/{id}, or /api/album/{id} endpoints with valid numeric identifiers, an attacker can overwrite or remove content belonging to other users, including items marked as private. This vulnerability significantly impacts the confidentiality and integrity of user data within the application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated users to perform unauthorized destructive or modification operations on resources belonging to other users, including private content. This can lead to total data loss for specific user items or unauthorized modification of shared resources, potentially affecting any multi-user deployment of the Shaark application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the Shaark application to a version beyond 1.2.44 immediately. Detection teams should monitor web server access logs for anomalous patterns of PUT or DELETE requests directed at the specified API controllers, particularly those involving sequential or high-volume ID increments from non-administrative user accounts.\u003c/p\u003e\n","date_modified":"2026-10-12T22:42:53Z","date_published":"2026-10-12T22:42:53Z","id":"https://feed.craftedsignal.io/briefs/2026-10-shaark-auth-bypass/","summary":"Shaark versions 1.2.13 through 1.2.44 contain a missing authorization vulnerability in multiple API controllers, allowing authenticated non-admin users to modify or delete content belonging to other users.","title":"Missing Authorization Vulnerability in Shaark API","url":"https://feed.craftedsignal.io/briefs/2026-10-shaark-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:shaark:shaark:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}