CVE-2026-34985CWE-639

LORIS has incorrect access checks in media module

Medium · published April 8, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
18.8
In the wild
Unconfirmed
What it is

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 16.1.0 to before 27.0.3 and 28.0.1, While the frontend of the media module filters files that the user should not have access to, the backend was not applying access checks and it would be possible for someone who should not have access to a file to access it if they know the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00275 · 18.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-08T18:22Z
EPSS history
Timeline
  • 08 APR 18:22Z
    LORIS has incorrect access checks in media module
    cvelistv5