CVE-2026-53634: Sharp Laravel CMS Auth Bypass Vulnerability

CVE-2026-53634 Overview

CVE-2026-53634 is a missing authorization vulnerability [CWE-862] in Sharp, a content management framework built as a Laravel package. The flaw affects the Quick Creation Command feature in versions 9.0.0 through 9.22.2. The create and store endpoints failed to enforce authorization checks, allowing authenticated Sharp users to bypass entity-level permission controls. An attacker with a valid Sharp session but lacking create permission on a target entity could retrieve the creation form or submit new records. The exploitation requires the target entity to have a Quick Creation Command handler configured. The maintainers released a fix in version 9.22.3.

Critical Impact
Authenticated users without create privileges can submit new records to Sharp entities exposing a Quick Creation Command handler, bypassing the application's authorization layer.

Affected Products

Sharp (code16/sharp) Laravel package versions 9.0.0 through 9.22.2
Laravel applications integrating Sharp with Quick Creation Command handlers
Fixed in Sharp version 9.22.3

Discovery Timeline

2026-06-10 - CVE-2026-53634 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-53634

Vulnerability Analysis

The vulnerability resides in ApiEntityListQuickCreationCommandController, which exposes the create and store endpoints for the Quick Creation Command feature. These controller actions never invoked the Sharp authorization manager before processing the request. As a result, the framework's per-entity permission model was silently skipped for this code path.

Any authenticated Sharp user could invoke the affected endpoints against an entity they were not authorized to modify. The attacker could fetch the creation form and submit a payload that the backend would persist as a new record. The impact is limited to entities configured with a Quick Creation Command handler.

This is a classic Broken Access Control issue mapped to [CWE-862] (Missing Authorization). It does not require credentials beyond a normal authenticated Sharp session.

Root Cause

The controller constructor and action methods omitted any call to authorizationManager->check(). The framework relies on each controller to assert entity-level permissions explicitly. Because the Quick Creation Command controller never performed that assertion, the authorization layer was effectively absent for this feature.

Attack Vector

An authenticated attacker sends an HTTP request to the Sharp Quick Creation Command create or store endpoint for a target entityKey. Sharp returns the creation form or accepts the submitted payload despite the user lacking create permission on that entity. The action vector requires network access to the Sharp admin interface and low-privilege authenticated access.

php

     use HandlesCommandForm;
     use HandlesCommandResult;
 
-    public function __construct(
-        private readonly SharpUploadManager $uploadManager,
-    ) {
+    public function __construct(private readonly SharpUploadManager $uploadManager)
+    {
         parent::__construct();
     }
 
     public function create(string $globalFilter, EntityKey $entityKey, EntityKey $formEntityKey)
     {
+        $this->authorizationManager->check('create', $entityKey);
         $entity = $this->entityManager->entityFor($entityKey);
 
         $list = $entity->getListOrFail();

Source: Sharp commit aa18a85 — the patch adds the missing authorizationManager->check('create', $entityKey) call to the create action.

Detection Methods for CVE-2026-53634

Indicators of Compromise

HTTP requests to Sharp Quick Creation Command endpoints under /sharp/api/list/{entityKey}/commands/entity/{commandKey}/quick-create originating from accounts not assigned create permissions.
Newly created entity records authored by users whose Sharp policy classes restrict the create ability for that entity.
Unusual spikes in POST traffic to Sharp command endpoints from low-privileged user sessions.

Detection Strategies

Review Laravel application logs and audit trails for create or store calls on Quick Creation Command routes correlated with the acting user's Sharp role.
Compare record created_by metadata against the authorization policy for the corresponding entity to surface unauthorized inserts.
Enable Sharp's authorization logging and replay recent requests against the patched policy logic to identify historical bypass attempts.

Monitoring Recommendations

Forward Laravel and web server access logs to a centralized analytics platform and alert on Quick Creation Command endpoint usage by accounts without entity-level create rights.
Add anomaly detection for accounts that suddenly begin creating records across entities they have never previously written to.
Monitor for repeated 200 OK responses on quick-create routes following privilege changes or session escalations.

How to Mitigate CVE-2026-53634

Immediate Actions Required

Upgrade code16/sharp to version 9.22.3 or later using Composer.
Audit all entities that register a Quick Creation Command handler and review records created during the exposure window.
Revoke or rotate sessions for Sharp users while verifying the integrity of recently created records.

Patch Information

The maintainers released the fix in Sharp v9.22.3 via pull request #729. The patch adds an explicit authorizationManager->check('create', $entityKey) call to the create action of ApiEntityListQuickCreationCommandController, ensuring the entity-level policy is evaluated before the form is rendered or the record is persisted. Full disclosure is available in GHSA-vmwx-m75v-qvch.

Workarounds

Temporarily remove Quick Creation Command handlers from entities until the upgrade to 9.22.3 is deployed.
Restrict access to the Sharp admin routes at the web server or reverse proxy layer for non-administrative users.
Add a middleware in front of the Sharp Quick Creation Command routes that re-validates the user's create ability against the requested entityKey.

bash

# Upgrade Sharp to the patched release
composer require code16/sharp:^9.22.3

# Verify the installed version
composer show code16/sharp | grep versions

# Clear Laravel route and config caches after upgrade
php artisan route:clear
php artisan config:clear