Loris CVE-2026-35165

CVSS 6.3 indicates medium severity with network-accessible attack vector (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L-authenticated user). The risk is contextual to LORIS deployment scope: self-hosted research institutions typically have a defined set of trusted users, reducing likelihood of external exploitation. However, insider threats (disgruntled researchers accessing sensitive neuroimaging data of other study participants) represent a real concern, particularly in regulated environments handling human subject data. No public exploit code, KEV status, or active exploitation reported; this appears to be a design flaw rather than an actively targeted vulnerability. Patch availability (versions 27.0.3 and 28.0.1) is confirmed, making remediation straightforward for most deployments. Real-world priority should be elevated for institutions handling protected health information (PHI) or sensitive participant data, despite moderate CVSS score.

An authenticated researcher with valid LORIS credentials could craft direct API requests to the backend document_repository endpoint, bypassing the frontend's access control layer. By enumerating or guessing filenames (e.g., common neuroimaging file naming conventions), the attacker could download sensitive imaging files or metadata belonging to other study participants. For example, an attacker might request a file path like /api/document_repository/download/participant_123_scan_2024.nii without frontend validation blocking the request, despite lacking explicit permission in the access control policy. No public exploit code or active exploitation in the wild has been reported.