Access Control Flaw in LORIS Imaging Browser Module Affects Data Management
CVE-2026-55147
6.3MEDIUM
What is CVE-2026-55147?
LORIS, a self-hosted web application designed for neuroimaging research, contains an access control issue in its imaging_browser module. This vulnerability allows authenticated API users to edit imaging data without the necessary frontend permissions. As a result, malicious insiders or compromised accounts could manipulate sensitive imaging data, leading to potential data integrity issues. It is crucial for users to upgrade to the fixed versions (27.0.4 and 28.0.2) to safeguard against unauthorized access. Alternatively, disabling the API can prevent exploitation if it is no longer in use.
Affected Version(s)
Loris >= 22.0.0, < 27.0.4 < 22.0.0, 27.0.4
Loris >= 28.0.0, < 28.0.2 < 28.0.0, 28.0.2