CyberRota Analysis
AI-GeneratedThe vulnerability in Shiori allows authenticated users to exploit the account update endpoint, enabling them to modify the owner field without proper authorization checks. By crafting a specific PATCH request, attackers can escalate their privileges to administrator level, gaining full system access through an admin JWT token. Organizations using Shiori should prioritize remediation to prevent potential unauthorized access and system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.