# CVE-2026-55146: LORIS issue tracker backend authorization bypass

Source: https://junglewise.ai/threats/cve-2026-55146-loris-longitudinal-online-research-and-imaging-system-is-a-self  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-55146 · Severity: medium · CVSS 4.3 · Published 2026-10-30

LORIS is a self-hosted web application for managing neuroimaging research data and projects. The issue tracker module failed to enforce backend access controls on issue edits, allowing authenticated users to modify issues they should not have access to. An attacker with valid credentials could alter any issue, potentially corrupting research data or disrupting project workflows.

Vendors: [ACES](https://junglewise.ai/threats/vendors/aces).

## Quick answers

**Is CVE-2026-55146 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55146 being exploited in the wild.

**How severe is CVE-2026-55146?** Medium severity, with a CVSS score of 4.3, published 30 October 2026.

**Which products and versions are affected?** ACES LORIS 16.0.0 to 27.0.3, 28.0.0 to 28.0.1.

**Is there a fix for CVE-2026-55146?** Yes: fixed in 27.0.4, 28.0.2. Until then: Deployments that no longer use the Issue Tracker module can disable the module to remove access to the vulnerable endpoint. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55146 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55146?** Check whether you run ACES LORIS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 27.0.4, 28.0.2

Deployments that no longer use the Issue Tracker module can disable the module to remove access to the vulnerable endpoint.

## Technical details

The `issue_tracker` backend in LORIS versions 16.0.0–27.0.3 and 28.0.0–28.0.1 does not verify edit permissions server-side, relying only on frontend restrictions. An authenticated attacker can craft backend requests to modify issues outside their permitted scope. The fix adds permission checks validating user roles (all-issue, site-level, or own-issue permissions) and center membership before allowing edits.

## Affected products

- ACES LORIS 16.0.0 to 27.0.3, 28.0.0 to 28.0.1

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/aces/Loris/commit/1856d1b4d48d4412d5a5a845024adb70858ec20d](https://github.com/aces/Loris/commit/1856d1b4d48d4412d5a5a845024adb70858ec20d)
- [https://github.com/aces/Loris/pull/10531](https://github.com/aces/Loris/pull/10531)

## Related threats

- [LORIS imaging_browser API permission bypass](https://junglewise.ai/threats/cve-2026-55147-loris-longitudinal-online-research-and-imaging-system-is-a-self)