Shiori’s CheckToken function validates only the JWT’s HMAC signature and returns the embedded claims without consulting the database for the current account state. Because the code never re‑fetches the account or checks a revocation list, a token belonging to a deleted or demoted user continues to grant the original owner privileges until it naturally expires, which can be up to 30 days when the "remember me" feature is enabled. This flaw is an improper authorization failure, consistent with CWE‑613, and allows an attacker holding a valid token to maintain elevated access after the intended revocation of those privileges.

The vulnerability affects the Shiori web application distributed under the go‑shiori:shiori project. No specific version range is provided in the advisory, so the issue applies to any releases that include the unmodified CheckToken implementation described in the repository.

The CVSS score of 8.2 reflects a high‑impact, high‑confidence scenario. Although no EPSS score is available, the fact that a token can remain valid for up to 30 days increases the attack window. The vulnerability is not listed in the CISA KEV catalog, suggesting that it may not yet have shown widespread exploitation. The most likely attack vector is the theft or reuse of an existing, still‑valid token; an adversary can use such a token on any instance of the affected Shiori application to perform privileged operations normally reserved for owners.