CVE-2026-55146

Received Received - Intake

Unauthorized Issue Modification in LORIS

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `issue_tracker` backend does not correctly verify edit access permissions, although the frontend restricts which issues a user may edit. An authenticated user can submit backend changes to issues outside the user's permitted edit scope. Deployments that no longer use Issue Tracker can disable the module to remove access to the endpoint. This issue is fixed in versions 27.0.4 and 28.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-55146

Affected Vendors & Products

Vendor	Product	Version / Range
aces	Loris	>= 16.0.0, < 27.0.4
aces	Loris	>= 28.0.0, < 28.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

LORIS is a web application for neuroimaging research that had a flaw in its issue tracker. The system did not properly check if users had permission to edit issues before allowing backend changes. While the frontend restricted visible issues, the backend allowed authenticated users to submit edits to issues outside their permitted scope.

Impact Analysis

An authenticated user could modify issues they should not have access to, potentially altering research data or project details. This could lead to data integrity issues or unauthorized changes in neuroimaging studies.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to sensitive research data, potentially violating data integrity and access control requirements under GDPR or HIPAA if such data is involved.

Mitigation Strategies

Update LORIS to version 27.0.4 or later if using 16.0.0 to 27.0.3, or to version 28.0.2 or later if using 28.0.0 to 28.0.1. Alternatively, disable the Issue Tracker module if it is no longer in use.

Hi! I’m here to help you understand CVE-2026-55146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70