Executive brief
LORIS, a web-based platform used for managing neuroimaging research data, contains a security flaw in its media module. While the user interface appears to restrict access to files, the underlying system fails to verify permissions when a file is requested directly. This allows an authenticated user to view or access sensitive research files belonging to others if they can guess or obtain the specific filename.
Technical details
An authorization bypass (CWE-639) exists in the media module of LORIS due to inconsistent security controls between the frontend and backend. While the frontend filters file visibility, the backend fails to perform server-side access validation. An attacker with low-privileged network access can bypass intended restrictions by directly requesting files via their filename. This vulnerability affects versions 16.1.0 through 27.0.2 and version 28.0.0. It has been remediated in versions 27.0.3 and 28.0.1.
Affected products
- aces Loris >= 16.1.0, < 27.0.3; 28.0.0
Timeline
- 2026-04-08: advisory: Vendor advisory published on GitHub
- 2026-04-08: disclosed
- 2026-04-08: patched