CVE-2026-61463 describes a privilege escalation vulnerability in the go-shiori project's Shiori product. The flaw exists in the account update endpoint where authenticated users can modify the 'owner' field without authorization validation. This allows an attacker with valid user credentials to escalate privileges to administrator by sending a specially crafted PATCH request setting owner: true. After this, re-authentication yields an admin JWT token, granting full administrative access to the system. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. There is no vendor advisory or patch available at this time, and the product is not a cloud service.

An authenticated user can escalate privileges to administrator level, gaining full system access through manipulation of the account update endpoint. This compromises the integrity and confidentiality of the system by allowing unauthorized administrative control. The vulnerability does not require user interaction and has low attack complexity, increasing the risk of exploitation. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for suspicious PATCH requests modifying the owner field. Avoid granting unnecessary privileges to users and consider additional application-layer controls to detect or block unauthorized privilege changes.