Περιγραφή
Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.
CVSS 8.8EPSS 0.368%Κίνδυνος 0.91
Προβολή πηγής- Δημοσίευση
- 2026-07-13 18:16:29
- Επηρεαζόμενες εκδόσεις
- unknown
- Τύπος
- Εφαρμογή ιστού
- Διάνυσμα
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H