The vulnerability in go-shiori's Shiori application involves insufficient session expiration controls (CWE-613). The CheckToken function validates JWT tokens solely by their HMAC signature and returns embedded claims without verifying the current account status from the database. Consequently, tokens issued to accounts that have been deleted or had their privileges reduced continue to authenticate with their original privileges until the token naturally expires. There is no session store or token revocation mechanism implemented, allowing potentially unauthorized access for up to 30 days when 'remember me' is enabled.

An attacker or user holding a valid JWT token can retain access with the original privileges even after the associated account is deleted or demoted. This can lead to unauthorized access with elevated privileges, compromising confidentiality and integrity of the system. The vulnerability has a high impact on confidentiality and integrity, with limited impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the 'remember me' feature to reduce token lifetime or implement manual token revocation mechanisms if possible. Monitor for updates from the go-shiori project regarding an official fix.