CVE-2026-71206

Name of the Vulnerable Software and Affected Versions Shiori (affected versions not specified)

Description The CheckToken() function in internal/domains/auth.go validates only the HMAC signature of the JSON Web Token (JWT) and returns the embedded Account object without re-fetching the account data from the database. Because the system lacks a session store or token-revocation mechanism, changes to an account—such as deletion or demotion from an owner to a regular role—do not affect existing tokens. Consequently, a token issued to a deleted or demoted owner remains valid and retains original owner-level privileges until it expires, which can take up to 30 days if the remember me option is enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.