Loris CVE-2026-35400

CVSS 3.5 (Low) with CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N reflects low intrinsic severity: network-accessible but requiring authenticated user with publication module privileges, low attack complexity, user interaction required (email recipient must click link), and limited integrity impact (email spoofing without confidentiality or availability breach). The EPSS and exploitation probability are not provided in input data. No KEV (CISA Known Exploited Vulnerabilities) confirmation, no public proof-of-concept, and no evidence of active exploitation. This is a privilege-gated account takeover or phishing enabler rather than a critical system compromise vector. Real-world risk is moderate for organizations running LORIS with multi-user publication workflows, as it could facilitate convincing spear-phishing or social engineering, but the requirement for both authentication and user interaction significantly limits opportunistic exploitation. Organizations where all publication module users are trusted staff face minimal risk; those where external collaborators have publication access face higher abuse potential.

An authenticated user with publication module access could craft a POST request to the publication email endpoint, submitting a baseURL parameter pointing to an attacker-controlled domain (e.g., attacker.com instead of legitimate-loris.org). When LORIS generates an automated email notification for publication approval or status update, the email would contain links or sender information referencing attacker.com, making it appear as though the notification originated from LORIS itself. If a recipient clicks a link or trusts the email as legitimate LORIS communication, they could be directed to a credential-harvesting phishing site or tricked into believing an attacker's message is official. No public exploit code is known to exist at time of analysis.