Go-Shiori Shiori
4 CVEs affecting Go-Shiori Shiori. Latest disclosed: 2026-08-05. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61463 | High | 8.8 | 2026-07-13 | Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authoriza… |
CVE-2026-71280 | High | 8.5 | 2026-08-05 | go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destina… |
CVE-2026-71206 | High | 8.3 | 2026-08-05 | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, neve… |
CVE-2025-60538 | Medium | 6.5 | 2026-01-09 | A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack. |