LORIS is a self‑hosted web application used for neuroimaging research. The API for the imaging_browser module does not enforce the same front‑end permission checks that restrict editing of imaging data. As a result, any authenticated user who can call the API may modify imaging data without the required edit authorization. This allows an attacker who has basic authentication credentials to tamper with study data, compromising data integrity and potentially invalidating research results.

The vulnerability exists in LORIS releases from version 22.0.0 through 27.0.3 and from 28.0.0 through 28.0.1, provided by the aces:Loris vendor. These affected versions were distributed under the GitHub repository for LORIS and are used by research institutions to manage imaging data sets.

The CVSS score of 6.3 indicates medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated API call; an attacker with basic authentication but without specific edit privileges can exploit the missing permission check to alter imaging records. Because the vulnerability operates purely through the API, disabling or restricting the API endpoint removes the exploitation path, while upgrading to 27.0.4 or 28.0.2 eliminates the flaw entirely.