Loris CVE-2026-35403

CVSS 6.5 (Medium) with CVSS vector AV:N/AC:H/PR:L/UI:R/S:C reflects realistic constraints: network-accessible but requiring authentication (PR:L), high attack complexity (AC:H), and mandatory user interaction (UI:R) such as clicking a malicious link. The high complexity requirement and need for victim interaction significantly reduce real-world exploitation probability compared to the numeric score. No EPSS score provided, but the combination of authentication requirement, user interaction requirement, and cross-site scope (S:C affecting other users/domains) suggests lower exploitation likelihood than unauthenticated RCE of equivalent CVSS. The vulnerability is of moderate concern for multi-user neuroimaging research platforms where researchers may receive phishing-style links from colleagues, but exploitation is not automated and requires social engineering. Organizations with strict access controls and security awareness training can further mitigate risk.

A researcher receives an email from what appears to be a colleague with a link claiming to contain critical survey feedback for a research participant. The link embeds a malicious visit label parameter. When the researcher (who is authenticated to LORIS) clicks the link, the survey_accounts module returns the attacker's payload without the proper application/json Content-Type header. The browser interprets the response as HTML and executes embedded JavaScript, which could steal the researcher's session cookie or redirect to a credential-harvesting site, compromising access to sensitive participant neuroimaging data. No public exploit code has been identified, but the attack is straightforward once a researcher is socially engineered into visiting a malicious link.