PT-2026-57840 · Shiori · Shiori

George Chen · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-61463

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shiori (affected versions not specified)

Description An issue exists in the account update endpoint that allows authenticated users to modify the owner field without proper authorization checks. By submitting a crafted PATCH request with owner: true, an attacker can escalate their privileges to administrator. After this modification, re-authenticating allows the user to obtain an admin JSON Web Token (JWT), which is a compact, URL-safe means of representing claims to be transferred between two parties, granting full system access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-61463

Affected Products

Shiori

References · 6

• 🔥 https://github.com/go-shiori/shiori/issues/1196 · Exploit
• https://github.com/go-shiori/shiori/commit/6c8a7dbc11b131609bfda736b14d61c51f9027b2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-61463 · Security Note
• https://github.com/go-shiori/shiori · Note
• https://twitter.com/VulmonFeeds/status/2076798612110024716 · Twitter Post
• https://vulncheck.com/advisories/shiori-authenticated-privilege-escalation-via-patch-api-v1-auth-account · Note