Technical impact
Shiori’s CheckToken function validates only the JWT’s HMAC signature and returns the embedded claims without consulting the database for the current account state. Because the code never re‑fetches the account or checks a revocation list, a token belonging to a deleted or demoted user continues to grant the original owner privileges until it naturally expires. This flaw is an improper authorization failure, consistent with CWE‑613, and allows an attacker holding a valid token to maintain elevated access after the intended revocation of those privileges.
Affected Systems
The vulnerability affects the Shiori web application distributed under the go‑shiori:shiori project. No specific version range is provided in the advisory, so the issue applies to any releases that include the unmodified CheckToken implementation described in the repository.
Risk and Exploitability
The CVSS score of 8.2 reflects a high‑impact, high‑confidence scenario. The EPSS score of 0.00215 (below 1%) indicates a very low but non‑zero probability that this vulnerability may be exploited in the wild, yet the fact that a token can remain valid until it expires widens the attack window. The vulnerability is not listed in the CISA KEV catalog, suggesting that it may not yet have shown widespread exploitation. The most likely attack vector is the theft or reuse of an existing, still‑valid token; an adversary can use such a token on any instance of the affected Shiori application to perform privileged operations normally reserved for owners.
