CVE-2026-109568: Authorization Bypass Through User-Controlled Key in MarceauKa Shaark

CVE-2026-109568 describes a missing authorization vulnerability in Shaark versions 1.2.13 through 1.2.44. The flaw exists in the Link, Story, Chest, and Album API controllers, where ownership checks are skipped. Authenticated users without admin privileges can exploit this by sending PUT or DELETE requests with numeric IDs to the /api/{link,story,chest,album}/{id} endpoints, allowing them to overwrite or delete content owned by other users, including private data.

This vulnerability allows authenticated non-admin users to modify or delete other users' content without proper authorization. This can lead to unauthorized data manipulation and potential privacy breaches of private content. The CVSS 4.0 score of 7.1 indicates a high severity impact with network attack vector, low attack complexity, no user interaction, and high impact on integrity and limited impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints to trusted users only and monitor for suspicious PUT or DELETE requests targeting other users' content. Avoid exposing these endpoints publicly if possible.