CVE-2026-61463 describes a privilege escalation vulnerability in the go-shiori project's Shiori product. The flaw exists in the account update endpoint, where authenticated users can modify the 'owner' field without authorization validation. By sending a specially crafted PATCH request with 'owner: true', an attacker can escalate privileges to administrator. After re-authentication, the attacker receives an admin JWT token, enabling full system control. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows an authenticated user to escalate privileges to administrator, gaining full system access via an admin JWT token. This can lead to complete compromise of the affected Shiori instance, including unauthorized data access and administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the account update endpoint to trusted users only and monitor for suspicious PATCH requests modifying the owner field. Avoid granting unnecessary privileges to authenticated users.