Description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `issue_tracker` backend does not correctly verify edit access permissions, although the frontend restricts which issues a user may edit. An authenticated user can submit backend changes to issues outside the user's permitted edit scope. Deployments that no longer use Issue Tracker can disable the module to remove access to the endpoint. This issue is fixed in versions 27.0.4 and 28.0.2.
Published: 2026-10-30
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized modification of issue data
Action: Apply Patch
AI Analysis

Impact

The LORIS issue_tracker backend fails to enforce edit permissions correctly. An authenticated user can change any issue regardless of the intended access controls. This bypass can alter issue details, status, and related information, compromising the integrity of project data.

Affected Systems

Affected versions include all releases from 16.0.0 up to, but not including, 27.0.4, and from 28.0.0 up to, but not including, 28.0.2. The vulnerability is present in the Aces:Loris web application. Deployments that no longer rely on the Issue Tracker feature can mitigate the risk by disabling the module, removing the vulnerable endpoint altogether.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is not available, but no listing in the CISA KEV catalog suggests low to moderate exploitation risk. Attackers need only authenticate against the application and must be able to submit a request to the edit endpoint; no external network leverage is required. If the module remains enabled, compromising an account or creating a new one on the system offers a straightforward path to modify issues surreptitiously.

Generated by OpenCVE AI on October 30, 2026 at 22:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Loris to version 27.0.4 or 28.0.2, or later, to apply the vendor‑supplied fix.
  • If an upgrade is not feasible immediately, disable the Issue Tracker module to eliminate the vulnerable endpoint.
  • Review and enforce strict user permissions and monitor activity logs to detect unauthorized issue modifications.

Generated by OpenCVE AI on October 30, 2026 at 22:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Aces
Aces loris
Vendors & Products Aces
Aces loris

Fri, 30 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `issue_tracker` backend does not correctly verify edit access permissions, although the frontend restricts which issues a user may edit. An authenticated user can submit backend changes to issues outside the user's permitted edit scope. Deployments that no longer use Issue Tracker can disable the module to remove access to the endpoint. This issue is fixed in versions 27.0.4 and 28.0.2.
Title LORIS has incorrect access checks in issue_tracker
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Aces Loris
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-30T21:32:36.340Z

Reserved: 2026-06-16T15:13:28.164Z

Link: CVE-2026-55146

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T22:16:54.650

Modified: 2026-10-30T22:16:54.650

Link: CVE-2026-55146

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T22:30:14Z

Weaknesses