Shiori contains a flaw in the account update endpoint: when an authenticated user submits a PATCH request, the owner field can be altered without any authorization checks. By setting owner: true, the attacker elevates their account to administrator status, thereby gaining full system access to bookmarks, configuration, and other privileged functions. The weakness maps to CWE‑269 (Improper Privilege Management).

The affected product is the open‑source web‑based bookmark manager Shiori, maintained by go‑shiori. Specific version numbers are not disclosed; any deployment that has not incorporated the commit 6c8a7dbc11b131609bfda736b14d61c51f9027b2 is potentially vulnerable.

The flaw scores a CVSS of 8.7, indicating high severity. The EPSS score is under 1 %, showing it is not listed in CISA’s KEV catalog. However, because the exploit requires only an authenticated session, the risk to any affected installation remains significant. An attacker who can log in can immediately convert themselves into an administrator by sending the crafted PATCH request.