# CVE-2026-55147: LORIS imaging_browser API permission bypass

Source: https://junglewise.ai/threats/cve-2026-55147-loris-longitudinal-online-research-and-imaging-system-is-a-self  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-55147 · Severity: medium · CVSS 6.3 · Published 2026-10-30

LORIS is a web application for managing neuroimaging research data. An authenticated attacker can modify imaging data through the API without proper permissions, potentially altering critical research records. This bypasses the access controls enforced in the user interface.

Vendors: [ACES](https://junglewise.ai/threats/vendors/aces).

## Quick answers

**Is CVE-2026-55147 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55147 being exploited in the wild.

**How severe is CVE-2026-55147?** Medium severity, with a CVSS score of 6.3, published 30 October 2026.

**Which products and versions are affected?** ACES LORIS 22.0.0 to 27.0.3, 28.0.0 to 28.0.1.

**Is there a fix for CVE-2026-55147?** Yes: fixed in LORIS 27.0.4, 28.0.2. Until then: Deployments that no longer use the API can disable it to remove access to this endpoint. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55147 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55147?** Check whether you run ACES LORIS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in LORIS 27.0.4, 28.0.2

Deployments that no longer use the API can disable it to remove access to this endpoint.

## Technical details

The API endpoint for the imaging_browser module's QC status editing fails to check user permissions that are enforced by the frontend, allowing authenticated API callers to modify MRI QC data without the required imaging_browser_qc permission and project access. The vulnerability affects versions 22.0.0–27.0.3 and 28.0.0–28.0.1, fixed by adding permission checks to the PUT handler in the QC endpoint.

## Affected products

- ACES LORIS 22.0.0 to 27.0.3, 28.0.0 to 28.0.1

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/aces/Loris/commit/b13053597530ee33fbced35085d2490bc9ccc03a](https://github.com/aces/Loris/commit/b13053597530ee33fbced35085d2490bc9ccc03a)
- [https://github.com/aces/Loris/pull/10531](https://github.com/aces/Loris/pull/10531)

## Related threats

- [LORIS issue tracker backend authorization bypass](https://junglewise.ai/threats/cve-2026-55146-loris-longitudinal-online-research-and-imaging-system-is-a-self)