Shiori CVE-2026-61463

Exploitation requires a valid authenticated Shiori account of any privilege level (PR:L) and network reachability to the API; the attacker sends a PATCH request to the /api/v1/auth/account update endpoint including the owner field set to true, then re-authenticates to obtain the elevated JWT. The limiting factor is that the attacker must first possess a non-owner account, so instances that disable self-registration and only provision accounts for fully trusted users sharply reduce realistic risk; single-user private deployments are not exposed to external attackers. No specific non-default feature or platform is required - the vulnerable endpoint is part of the standard account-management functionality.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity attack needing only low privileges and no user interaction, yielding full confidentiality, integrity and availability impact on the vulnerable system. The single meaningful barrier is PR:L: an attacker must already hold a valid (non-owner) account, so exposure hinges on whether the Shiori instance permits self-registration or shares accounts among semi-trusted users; a single-user private instance is effectively not at risk from external actors. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active or automated exploitation - this is a high-severity but not currently-exploited-in-the-wild issue. The vulnerability class is trivially exploitable once an account exists (a one-line JSON body), so any multi-user or publicly-registerable deployment should treat it as an immediate priority despite the absence of exploitation telemetry.

An attacker registers or is granted an ordinary Shiori account on a shared or internet-exposed instance, then sends a single PATCH request to the account-update endpoint with the JSON body {"owner": true}. The server persists the change without an authorization check, so the attacker logs out and back in, receives an admin JWT, and gains full control over all bookmarks, users, and system settings. No public POC was provided, but the attack is a trivial one-line request given AV:N/AC:L and no required user interaction.