Executive brief
Shiori, a simple bookmark manager, contains a security flaw that allows any registered user to grant themselves administrative privileges. By sending a specially crafted request to their own account settings, a standard user can become a system owner. This allows an attacker to gain full control over the application, including access to other users' data and system configurations.
Technical details
A privilege escalation vulnerability exists in Shiori's account update endpoint (`PATCH /api/v1/auth/account`). The `HandleUpdateLoggedAccount` handler in `internal/http/handlers/api/v1/auth.go` is protected only by a basic login requirement and fails to validate whether a user is authorized to modify the `owner` field. An authenticated attacker can submit a crafted JSON payload containing `"owner": true`. The application's DTO mapping and database logic subsequently update the user's record to administrative status. Upon re-authentication or token refresh, the attacker receives a new JWT with administrative claims, granting full access to the system. This is fixed in version 1.8.0.
Affected products
- go-shiori shiori < 1.8.0
Timeline
- 2026-05-28: other: Vulnerability reported privately to maintainers
- 2026-07-03: disclosed: Public issue opened on GitHub
- 2026-07-13: advisory: CVE published and NVD record created
- 2026-07-13: patched: Fix committed in repository and version 1.8.0 released