Access Control Flaw in LORIS Backend Affects Neuroimaging Data Management
CVE-2026-55146
4.3MEDIUM
What is CVE-2026-55146?
LORIS, a self-hosted web application for neuroimaging research, faces an access control issue in certain versions where the backend does not properly verify user edit permissions. Although the frontend restricts editing capabilities, authenticated users may exploit this flaw to submit backend changes beyond their authorized scope. To enhance security, it is recommended that users disable the 'Issue Tracker' module if not in use. This vulnerability is resolved in LORIS versions 27.0.4 and 28.0.2.
Affected Version(s)
Loris >= 16.0.0, < 27.0.4 < 16.0.0, 27.0.4
Loris >= 28.0.0, < 28.0.2 < 28.0.0, 28.0.2