Vulnerability Description
Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/go-shiori/shiori
- https://github.com/go-shiori/shiori/commit/6c8a7dbc11b131609bfda736b14d61c51f902
- https://github.com/go-shiori/shiori/issues/1196
- https://www.vulncheck.com/advisories/shiori-authenticated-privilege-escalation-v
- https://github.com/go-shiori/shiori/issues/1196
FAQ
What is CVE-2026-61463?
CVE-2026-61463 is a vulnerability with a CVSS score of 8.8 (HIGH). Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to ad...
How severe is CVE-2026-61463?
CVE-2026-61463 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61463?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.