Is CVE-2026-34985 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34985 being exploited in the wild.

How severe is CVE-2026-34985?

Medium severity, with a CVSS score of 6.3, published 8 April 2026.

Which products and versions are affected?

aces Loris >= 16.1.0, < 27.0.3; 28.0.0.

Is there a fix for CVE-2026-34985?

A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34985 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-34985?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34985: aces LORIS authorization bypass in media module

Q: Is there a fix for CVE-2026-34985?

A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34985 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-34985?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34985 · Severity: medium · CVSS 6.3 · Published 2026-04-08

LORIS, a web-based platform used for managing neuroimaging research data, contains a security flaw in its media module. While the user interface appears to restrict access to files, the underlying system fails to verify permissions when a file is requested directly. This allows an authenticated user to view or access sensitive research files belonging to others if they can guess or obtain the specific filename.

Quick answers

Is CVE-2026-34985 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34985 being exploited in the wild.
How severe is CVE-2026-34985?: Medium severity, with a CVSS score of 6.3, published 8 April 2026.
Which products and versions are affected?: aces Loris >= 16.1.0, < 27.0.3; 28.0.0.
Is there a fix for CVE-2026-34985?: A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34985 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-34985?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass (CWE-639) exists in the media module of LORIS due to inconsistent security controls between the frontend and backend. While the frontend filters file visibility, the backend fails to perform server-side access validation. An attacker with low-privileged network access can bypass intended restrictions by directly requesting files via their filename. This vulnerability affects versions 16.1.0 through 27.0.2 and version 28.0.0. It has been remediated in versions 27.0.3 and 28.0.1.

Affected products

aces Loris >= 16.1.0, < 27.0.3; 28.0.0

Timeline

2026-04-08: advisory: Vendor advisory published on GitHub
2026-04-08: disclosed
2026-04-08: patched

References

https://github.com/aces/Loris/security/advisories/GHSA-p42c-4gmq-hrjw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.