Junglewise Threat Intelligence

CVE-2026-61463: Go-Shiori Shiori privilege escalation in account update endpoint

CVE-2026-61463 · Severity: high · CVSS 8.8 · Published 2026-07-13

Executive brief

Shiori, a simple bookmark manager, contains a security flaw that allows any registered user to grant themselves administrative privileges. By sending a specially crafted request to their own account settings, a standard user can become a system owner. This allows an attacker to gain full control over the application, including access to other users' data and system configurations.

Technical details

A privilege escalation vulnerability exists in Shiori's account update endpoint (`PATCH /api/v1/auth/account`). The `HandleUpdateLoggedAccount` handler in `internal/http/handlers/api/v1/auth.go` is protected only by a basic login requirement and fails to validate whether a user is authorized to modify the `owner` field. An authenticated attacker can submit a crafted JSON payload containing `"owner": true`. The application's DTO mapping and database logic subsequently update the user's record to administrative status. Upon re-authentication or token refresh, the attacker receives a new JWT with administrative claims, granting full access to the system. This is fixed in version 1.8.0.

Affected products

  • go-shiori shiori < 1.8.0

Timeline

  • 2026-05-28: other: Vulnerability reported privately to maintainers
  • 2026-07-03: disclosed: Public issue opened on GitHub
  • 2026-07-13: advisory: CVE published and NVD record created
  • 2026-07-13: patched: Fix committed in repository and version 1.8.0 released

References