CVE-2026-53634: Sharp Laravel CMS Authorization Bypass in Quick Creation Feature

Technical summary

The Quick Creation Command feature in Sharp 9.0.0–9.22.2 fails to enforce authorization checks on its create and store endpoints. While Sharp's standard authorization system protects entity creation, the Quick Creation Command implementation does not perform the required authorization validation before allowing users to access the creation form or persist new records. An authenticated attacker with a valid session but lacking explicit create permissions on a target entity can exploit this gap by directly accessing the unprotected endpoints. The issue is rooted in missing authorization middleware or permission checks specific to the Quick Creation Command handlers (CWE-862: Missing Authorization).

Business impact

Organizations using Sharp for content management face a controlled but meaningful risk: internal users or accounts with limited privileges could create unauthorized records in systems they should not have write access to. In multi-tenant or role-based environments, this undermines data governance and audit trails. The blast radius is confined to authenticated users and only to entities with Quick Creation Command handlers, but the impact on data integrity and compliance reporting could be significant. Any system relying on Sharp's permission model to enforce separation of duties or access control would be weakened.

Affected systems

Sharp versions 9.0.0 through 9.22.2 are affected. The vulnerability only manifests for entities that have a Quick Creation Command handler configured; entities without this handler are not exploitable. Sharp is a Laravel package, so affected instances run in PHP/Laravel environments. Organizations should audit their Sharp installations to identify which entities have Quick Creation Command handlers and prioritize patching those instances.

Exploitability

Exploitability is moderate. An attacker must already be authenticated as a Sharp user, reducing external threat surface. However, the authorization bypass is straightforward once an attacker understands the endpoint pattern—no complex interaction, unusual network conditions, or user action is required. The CVSS score of 4.3 (MEDIUM) reflects this: network-accessible, low attack complexity, but limited to authenticated attackers and with only integrity impact (unauthorized record creation, no confidentiality breach or availability degradation). The vulnerability is unlikely to be exploited at scale given that it requires prior authentication and knowledge of entity configurations.

Remediation

Upgrade Sharp to version 9.22.3 or later. This patch adds proper authorization enforcement to the Quick Creation Command create and store endpoints, ensuring that the same permission checks applied to standard entity creation are also applied to the Quick Creation pathway. Review your Laravel application's dependency management tool (Composer) to confirm the upgrade; verify against your vendor's official advisory for any additional mitigation or configuration changes needed.

Patch guidance

1. Update Sharp in your composer.json to require version 9.22.3 or later (e.g., 'codesign/sharp': '^9.22.3'). 2. Run 'composer update codesign/sharp' to fetch the patched version. 3. Test your Quick Creation Command features in a staging environment to ensure no functional regression. 4. Review any custom Quick Creation Command handlers to confirm they align with Sharp's updated authorization patterns. 5. Deploy to production and monitor for any permission-related incidents. If your Sharp installation predates 9.0.0, you are not affected. If you are on 9.x but have not configured Quick Creation Command handlers, the risk is lower but patching is still recommended for defense-in-depth.

Detection guidance

Monitor access logs for repeated attempts to access Quick Creation Command endpoints (/sharp/api/quick-create or similar routes) by users who do not have standard create permissions on those entities. Audit Sharp's activity logs for record creation events attributed to users without explicit create roles. Review your entity configuration to identify which entities have Quick Creation Command handlers enabled. Search your application code and database for any suspicious records created before the patched version was deployed, cross-referencing user accounts and timestamps. In a Laravel/PHP environment, enable detailed logging of authorization failures and check for patterns of permission-denied events followed by successful record creation via Quick Creation endpoints.

Why prioritize this

While the CVSS score is MEDIUM (4.3) and the vulnerability requires authentication, it directly undermines your authorization model. Any Sharp-based system relying on role-based access control to prevent unauthorized data creation should treat this as a near-term priority. Organizations with strict compliance or audit requirements (financial services, healthcare, regulated manufacturing) should patch urgently. Even in less regulated environments, the fix is straightforward and carries low deployment risk, making it suitable for rapid patching.

Risk score, explained

The CVSS 3.1 score of 4.3 is driven by: (1) Network-accessible attack surface (AV:N), (2) Low attack complexity (AC:L), (3) Requirement for prior authentication (PR:L), (4) No scope change (S:U), (5) No confidentiality impact (C:N), but integrity impact (I:L) from unauthorized record creation, and (6) No availability impact (A:N). The score appropriately reflects that while the flaw is in a commonly exposed web endpoint, it requires a valid user account and only allows data modification, not disclosure or system disruption. Organizations with broader attack surfaces or highly privileged users should consider this on the higher end of MEDIUM severity.

Frequently asked questions