LORIS features a document_repository frontend that restricts file access, but its backend endpoint lacks proper permission verification. This flaw allows a user to retrieve files they should not access if the file name is known or guessable, resulting in potential leakage of confidential research data. The weakness aligns with improper authorization checks, exposing user information to unauthorized actors.

LORIS, a self-hosted web application for neuroimaging research, is affected in versions 21.0.0 through 26.x, prior to 27.0.3, and before 28.0.1. Rolling updates to 27.0.3 or 28.0.1 eliminate the issue.

The vulnerability scores a CVSS of 6.3, indicating moderate severity. With no EPSS score available, the likelihood of exploitation is uncertain, but the absence from the CISA KEV catalog suggests it has not been publicly exploited as of now. Because the attack requires knowledge of a filename or brute‑forcing filenames, the vector is inferred to be remote via the web interface rather than a local privilege escalation. Once exploited, an attacker could obtain non‑public files, compromising confidentiality of research data.