CVE-2026-53634
Sharp Missing Authorization Check in Quick Creation Command Endpoints
Description
### Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. ### Patches Yes. The fix is included in version 9.22.3. Users should upgrade to that version or later. ### Workarounds Remove or disable Quick Creation Command handlers (quickCreationCommandHandler()) on any entity list where unauthorized access is a concern, until an upgrade is possible. ### Resources [PR #729](https://github.com/code16/sharp/pull/729)
How to fix CVE-2026-53634
To remediate CVE-2026-53634, upgrade the affected package to a fixed version below.
- —upgrade to 9.22.3 or later
Is CVE-2026-53634 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 9.0.0, < 9.22.3
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |