MEDIUMCVSS 5.4Vulnerability
CVE-2026-84974
### Impact An authenticated attacker can instantiate any class in the PHP application by using the `embed_key` parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the `__construct()` method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method. ### Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that `embed_key` is a class extending `SharpFormEditorEmbed` before any instantiation. ### Workarounds No known workarounds.
Properties
- Severity
- medium
- Summary
- code16/sharp: Arbitrary class instantiation through the embed_key API parameter
- Cvss score
- 5.4
- Retrieved at
- 2026-11-14T00:50:09+00:00
- Ghsa published
- 2026-11-12T18:18:44Z
- Source url
- https://github.com/advisories/GHSA-h24v-f482-8cwf
- Ghsa updated
- 2026-11-12T18:18:45Z
- Ghsa id
- GHSA-h24v-f482-8cwf
- Last source
- GitHub Advisory Database
- Cve id
- CVE-2026-84974
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- First seen by Signal
- 2026-11-12T19:59:26+00:00
- Name
- CVE-2026-84974
- Is ghsa only
- false
Related Entities (3)
AFFECTS (1)
HAS_WEAKNESS (1)
VULNERABLE_TO (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph