Shiori CVE-2026-71206

Exploitation requires that the attacker previously authenticated to the Shiori instance as an owner-level user and retained their JWT. The critical enabling condition is the absence of server-side session revocation: the flaw manifests specifically when an administrator deletes an account or demotes it from owner to a regular role after a token has been issued. The longer the 'remember me' option was selected at login, the wider the exploitation window - up to 30 days. Exploitation is limited by: (1) the attacker must have already been a legitimate owner-level user and must possess a previously-issued, non-expired JWT; (2) the Shiori instance must be reachable over the network; (3) exploitation window closes at natural token expiry. This is NOT exploitable by external unauthenticated attackers or by regular (non-owner) users who never held an owner token. Single-user Shiori deployments are not meaningfully affected since account revocation is not a relevant operation.

The NVD CVSS 3.1 score of 8.3 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) accurately reflects the mechanics: exploitation is network-accessible, low complexity, and requires no user interaction, but does require a previously-issued low-privilege (owner-level) JWT - PR:L is appropriate. Real-world risk is meaningful but context-dependent: this flaw matters most in multi-user Shiori deployments with staff turnover or access control requirements, such as small teams or organizations using shared bookmark managers. For single-user personal deployments, the risk surface is negligible. There is no CISA KEV entry and no confirmed POC, so EPSS-equivalent exploitation pressure is likely low. The 30-day maximum window with 'remember me' is the critical amplifier - an attacker who plans ahead (e.g., saves a token before knowing their account will be deleted) has a wide window. The Availability impact component (A:L) is mild. No conflicting signals between CVSS vector and description - the network vector and low complexity are consistent with a web API token replay attack.

A departing employee who held an owner role in a shared Shiori instance saves their JWT before their account is deleted by an administrator. After the account is removed, they replay the saved token against the Shiori API; since CheckToken validates only the HMAC and returns the embedded claims without database re-check, the server accepts the request and grants full owner-level access to all bookmarks, tags, and administrative endpoints for up to 30 days if 'remember me' was used at login. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling to replay a bearer token.