CVE-2026-55147

Received Received - Intake

Unauthorized Imaging Data Modification in LORIS

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `API` for the `imaging_browser` module permits edits to imaging data without checking the frontend permissions that restrict editing in Imaging Browser. An authenticated `API` caller can therefore modify imaging data without the required edit authorization. Deployments that no longer use the `API` can disable it to remove access to this endpoint. This issue is fixed in versions 27.0.4 and 28.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-55147

Affected Vendors & Products

Vendor	Product	Version / Range
aces	Loris	>= 22.0.0, < 27.0.4
aces	Loris	>= 28.0.0, < 28.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

LORIS is a web application for neuroimaging research. This vulnerability allows authenticated users to edit imaging data through the API without proper frontend permission checks. The API endpoint for the imaging_browser module does not enforce edit restrictions, letting unauthorized users modify data.

Impact Analysis

An attacker with API access could alter imaging data, leading to incorrect research results or compromised studies. This could affect data integrity, mislead analyses, or violate compliance requirements for research data.

Compliance Impact

This vulnerability may violate data integrity and access control requirements under GDPR and HIPAA. Unauthorized modifications to imaging data could result in non-compliance, potential fines, or legal consequences for research institutions handling sensitive health data.

Mitigation Strategies

Update LORIS to version 27.0.4 or 28.0.2 or later to fix the vulnerability. If the imaging_browser API is not used, disable it to remove access to the vulnerable endpoint.

Hi! I’m here to help you understand CVE-2026-55147. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70