Privilege Escalation in Shiori via Unauthorized Owner Field Modification

Executive Summary

CVE-2026-61463 is a privilege escalation vulnerability in Shiori, a bookmark manager built with Go. The vulnerability exists in the account update endpoint (/api/v1/auth/account) and allows authenticated users to modify the owner field without proper authorization checks.

An attacker can exploit this by sending a crafted PATCH request to the endpoint, setting the owner field to true. This action escalates their privileges to administrator level. After modifying the owner field, the attacker can re-authenticate to obtain an admin JWT token, which grants full system access.

• The vulnerability affects Shiori versions prior to 1.8.0.
• The flaw is classified as CWE-269 (Improper Privilege Management).
• The CVSS v4.0 score is 8.7, indicating a high severity.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can check for suspicious activity related to the Shiori account update endpoint. The vulnerability involves unauthorized modification of the 'owner' field via a PATCH request to /api/v1/auth/account.

• Review server logs for PATCH requests to /api/v1/auth/account, especially those containing the 'owner: true' field. Look for requests from non-admin users or unusual IP addresses.
• Check for unexpected admin-level JWT tokens in authentication logs. Compare the list of admin users before and after suspicious activity to identify unauthorized privilege escalations.
• Use network monitoring tools to inspect HTTP traffic for requests to the vulnerable endpoint. Example command for tcpdump to capture relevant traffic: tcpdump -i any -s 0 -A 'tcp port 80 or tcp port 443 and (host your-shiori-server) and (port http or port https)' | grep -i 'PATCH /api/v1/auth/account'.
• Verify the installed version of Shiori. If it is prior to 1.8.0, it is likely vulnerable. You can check the version by reviewing the application's configuration or running: curl -I http://your-shiori-instance/api/v1/info (if the endpoint is accessible).
• Inspect the Shiori database for unexpected changes to the 'owner' field in user accounts. For example, query the database to list all users with the 'owner' field set to true and verify their legitimacy.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of Shiori (prior to 1.8.0), this vulnerability can have severe consequences for your system and data.

• An attacker with authenticated access can escalate their privileges to administrator, gaining full control over the Shiori instance.
• With admin access, the attacker can list all user accounts, create backdoor accounts, delete users, and access sensitive data stored in the system.
• The vulnerability can be exploited silently if the attacker leverages a permissive CORS policy, allowing malicious websites to trigger the attack against logged-in users without their knowledge.
• This could lead to unauthorized access to bookmarks, user credentials, or other confidential information managed by Shiori.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can significantly impact compliance with common standards and regulations, depending on the type of data managed by Shiori and the applicable legal frameworks.

• GDPR (General Data Protection Regulation): If Shiori is used to store or manage personal data of EU citizens, this vulnerability could lead to unauthorized access to such data. Under GDPR, organizations must implement appropriate security measures to protect personal data. A breach resulting from this vulnerability could be considered a failure to comply with GDPR's security requirements (Article 32), potentially leading to fines and legal consequences.
• HIPAA (Health Insurance Portability and Accountability Act): If Shiori is used in a healthcare setting to store or manage protected health information (PHI), this vulnerability could result in unauthorized access to PHI. HIPAA requires covered entities to implement safeguards to protect PHI. A breach due to this vulnerability could violate HIPAA's Security Rule, leading to penalties and mandatory corrective actions.
• Other standards (e.g., ISO 27001, NIST): Compliance with information security standards like ISO 27001 or NIST frameworks requires organizations to manage access controls and prevent unauthorized privilege escalation. This vulnerability represents a failure to meet such requirements, potentially resulting in non-compliance and associated risks.

Organizations using Shiori should assess whether the data managed by the application falls under any regulatory requirements and take immediate steps to mitigate the vulnerability to avoid compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Shiori to version 1.8.0 or later, which includes the fix for this vulnerability. The patch was introduced in commit 6c8a7db. Follow the official upgrade instructions from the Shiori GitHub repository.
• If upgrading is not immediately possible, apply a temporary workaround by restricting access to the /api/v1/auth/account endpoint. Use network-level controls (e.g., firewalls, WAF rules) to block PATCH requests to this endpoint from unauthorized users.
• Review all user accounts in the Shiori database to ensure no unauthorized users have the 'owner' field set to true. Manually correct any discrepancies and audit the list of admin users.
• Rotate all admin-level JWT tokens to invalidate any potentially compromised tokens. Force all users to re-authenticate to obtain new tokens.
• Enable detailed logging for the /api/v1/auth/account endpoint to monitor for any further attempts to exploit this vulnerability. Log all PATCH requests and their payloads for forensic analysis.
• Review and tighten CORS policies to prevent cross-origin requests from triggering the vulnerability. Ensure that only trusted origins can interact with the Shiori API.
• Monitor for signs of exploitation, such as unexpected admin users or unusual activity in admin-only functions (e.g., listing all users, creating backdoor accounts).

Useful 0 Not Useful 0