CVE-2026-35165
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In LORIS (Longitudinal Online Research and Imaging System) versions 21.0.0 through 27.0.3 and 28.0.1, the backend document endpoint did not properly verify access permissions. Although the frontend restricted file access, a user could theoretically download a file they should not have access to if they know or can brute force the filename.
Risk Assessment
An unauthorized user may gain access to sensitive files, violating security policy and potentially leading to data leakage.
Recommendation
Upgrade LORIS to version 27.0.3 or 28.0.1, which fix this vulnerability.
Original NVD description (English source)
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 21.0.0 to before 27.0.3 and 28.0.1, while the document_repository frontend was restricting file access, the backend endpoint was not correctly verifying access permissions. A user could theoretically download a file that they should not have access to, if they know or can brute force the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.