CVE-2026-61463
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.
Risk Assessment
The risk is that any authenticated user can gain unrestricted administrative access to the Shiori system, potentially leading to full compromise of the application and its data.
Recommendation
Immediately update Shiori to the latest version that includes a fix for this vulnerability, and review and strengthen access control mechanisms in the account update endpoint.
Other vulnerabilities in Shiori
Original NVD description (English source)
Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.