File Access Control Flaw in LORIS Neuroimaging Web Application
CVE-2026-35165

6.3MEDIUM

Key Information:

Vendor

Aces

Status
Loris
Vendor
CVE Published:
8 April 2026

What is CVE-2026-35165?

A vulnerability exists in the LORIS web application where the backend endpoint fails to properly verify access permissions for file downloads. Users can potentially exploit this flaw to access and download files they should not be able to, given knowledge of or brute-forcing the filename. This issue affects versions 21.0.0 through before 27.0.3 and 28.0.1, and has been addressed in subsequent updates.

Affected Version(s)

Loris >= 21.0.0, < 27.0.3 < 21.0.0, 27.0.3

Loris >= 28.0.0, < 28.0.1 < 28.0.0, 28.0.1

References

https://github.com/aces/Loris/security/advisories/GHSA-qp...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.