CVE-2026-61463: Shiori Authenticated Privilege Escalation via PATCH /api/v1/auth/account
Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61463?
The severity of CVE-2026-61463 is high, with a score of 8.8.
How do I fix CVE-2026-61463?
To fix CVE-2026-61463, update to the latest version of Shiori that addresses the privilege escalation vulnerability.
What type of vulnerability is CVE-2026-61463?
CVE-2026-61463 is classified as an authenticated privilege escalation vulnerability.
What can attackers do with CVE-2026-61463?
Attackers can exploit CVE-2026-61463 to modify the owner field and escalate their privileges to that of an administrator.
Which endpoint is affected by CVE-2026-61463?
The vulnerability CVE-2026-61463 affects the /api/v1/auth/account endpoint during account updates.