GSSA-2026-04-EHB7HE2026-04-254.0 Medium
Missing input validation function on guild customization endpoint
The guild customization PATCH endpoint called a `validateCustomization()` function that was never defined, causing the route to throw `ReferenceError`. The intended input validation (avatar/banner data URI checks, length limits) was therefore absent.
The guild customization PATCH endpoint called a validateCustomization() helper that was never defined or imported, causing every request to throw ReferenceError. The intended whitelisting and avatar/banner data-URI checks were therefore absent.