The vulnerability is a potential cross‑site scripting flaw in the survey_accounts module. When a user supplies an invalid visit label, the response is properly JSON encoded but the Content‑Type header is omitted, causing browsers to treat the payload as HTML. If an attacker crafts a link that includes malicious JavaScript, a victim who clicks that link could have arbitrary code executed in their browser context.

Systems running LORIS versions from 15.10 up to, but not including, 27.0.3 and 28.0.1 are affected. The issue is confined to the survey_accounts module and resolves once the application is upgraded to at least 27.0.3 or 28.0.1.

The CVSS score of 6.5 indicates a moderate severity risk. Exploitation requires a victim to follow a crafted link, so social engineering is needed. The EPSS score is unavailable, but the moderate CVSS suggests a non‑high likelihood of widespread exploitation. The flaw is not listed in the CISA KEV catalog, reducing the likelihood of public attacks yet the risk remains if a malicious actor targets a vulnerable deployment.