Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 21.0.0 to before 27.0.3 and 28.0.1, while the document_repository frontend was restricting file access, the backend endpoint was not correctly verifying access permissions. A user could theoretically download a file that they should not have access to, if they know or can brute force the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-08 | 1 | General1 |
| 2026-04-09 | 1 | Disclosure1 |
CVE-2026-35165 Unauthorized File Access in LORIS 21.0.0 Through 28.0.0 via Backend Permission Bypass https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35165
Post summary
The post announces CVE-2026-35165, highlighting an unauthorized file access vulnerability due to backend permission bypass across LORIS 21.0.0–28.0.0, without providing PoC, exploit, or patch details.
CVE-2026-35165 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 21… https://www.cve.org/CVERecord?id=CVE-2026-35165
Post summary
The post references CVE-2026-35165 for LORIS, providing only a brief application description and a link to the CVE record, with no additional exploit, patch, or technical details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mcgill | loris | - | - | - |
| App | mcgill | loris | 28.0.0 | - | - |