GSSA-2026-04-EHB7HE2026-04-25
4.0 Medium

Missing input validation function on guild customization endpoint

The guild customization PATCH endpoint called a `validateCustomization()` function that was never defined, causing the route to throw `ReferenceError`. The intended input validation (avatar/banner data URI checks, length limits) was therefore absent.

The guild customization PATCH endpoint called a validateCustomization() helper that was never defined or imported, causing every request to throw ReferenceError. The intended whitelisting and avatar/banner data-URI checks were therefore absent.