# CVE-2026-44692: code16 Sharp authorization bypass in generic download endpoint

Source: https://junglewise.ai/threats/cve-2026-44692-code16-sharp-authorization-bypass-in-generic-download-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-44692 · Severity: high · CVSS 7.7 · Published 2026-06-10

Sharp, a content management framework for Laravel, contains a vulnerability that allows authenticated users to download files they are not authorized to access. By manipulating request parameters on a valid download link, a user could access sensitive data such as backups, invoices, or internal documents stored on the server's storage disks. This could lead to the exposure of private customer data or operational files belonging to other users or tenants.

Technologies: [Code16 Sharp](https://junglewise.ai/threats/technologies/sharp), [code16/sharp (Packagist)](https://junglewise.ai/threats/technologies/code16-sharp). Vendors: [Code16](https://junglewise.ai/threats/vendors/code16), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-44692 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44692 being exploited in the wild.

**How severe is CVE-2026-44692?** High severity, with a CVSS score of 7.7, published 10 June 2026.

**Which products and versions are affected?** Code16 Sharp < 9.22.0; code16/sharp (Packagist) < 9.22.0, ECOSYSTEM:introduced=0,fixed=9.22.0.

**Is there a fix for CVE-2026-44692?** Yes. code16/sharp (Packagist): upgrade to 9.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44692 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44692?** Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code16/sharp (Packagist): upgrade to 9.22.0 or later

  ```sh
  composer require code16/sharp:^9.22.0
  ```


## Technical details

A vulnerability exists in Sharp's generic download endpoint (GET /sharp/{globalFilter}/download/{entityKey}/{instanceId?}) where authorization is verified for a specific entity instance, but the actual file retrieval is based on user-controlled 'disk' and 'path' request parameters. Because the requested storage object is not cryptographically or logically bound to the authorized entity instance, an authenticated attacker with view access to at least one valid record can use it as an 'authorization anchor' to download any file from configured Laravel Storage disks. This is classified as an Insecure Direct Object Reference (IDOR) or Authorization Bypass Through User-Controlled Key (CWE-639). The issue is resolved in version 9.22.0 by implementing signed URLs that prevent parameter tampering.

## Affected products

- code16 sharp < 9.22.0

## Identifiers

- CVE-2026-44692
- GHSA-748w-hm6r-qc7v

## Timeline

- 2026-05-15: advisory
- 2026-05-15: disclosed
- 2026-05-15: patched: Fixed in version 9.22.0

## References

- [https://api.github.com/users/baradika](https://api.github.com/users/baradika)
- [https://github.com/baradika](https://github.com/baradika)
- [https://api.github.com/users/baradika/gists%7B/gist_id%7D](https://api.github.com/users/baradika/gists%7B/gist_id%7D)
- [https://api.github.com/users/baradika/repos](https://api.github.com/users/baradika/repos)
- [https://avatars.githubusercontent.com/u/137510281?v=4](https://avatars.githubusercontent.com/u/137510281?v=4)
- [https://api.github.com/users/baradika/events%7B/privacy%7D](https://api.github.com/users/baradika/events%7B/privacy%7D)

## Related threats

- [code16/sharp server-side request forgery in autocomplete endpoint](https://junglewise.ai/threats/cve-2026-84987-code16-sharp-server-side-request-forgery-through-an-unanchored)
- [Code16 Sharp arbitrary class instantiation in embed_key parameter](https://junglewise.ai/threats/cve-2026-84974-code16-sharp-arbitrary-class-instantiation-through-the-embed-key)
- [code16 Sharp stored XSS via sanitizer bypass](https://junglewise.ai/threats/cve-2026-61825-code16-sharp-stored-xss-via-sanitizer-bypass)
- [code16 Sharp stored XSS in iframe srcdoc attribute](https://junglewise.ai/threats/cve-2026-61823-code16-sharp-stored-xss-in-iframe-srcdoc-attribute)
- [code16 Sharp missing authorization in Quick Creation Command endpoints](https://junglewise.ai/threats/cve-2026-53634-code16-sharp-missing-authorization-in-quick-creation-command)