CVE-2026-55147

What it is

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `API` for the `imaging_browser` module permits edits to imaging data without checking the frontend permissions that restrict editing in Imaging Browser. An authenticated `API` caller can therefore modify imaging data without the required edit authorization. Deployments that no longer use the `API` can disable it to remove access to this endpoint. This issue is fixed in versions 27.0.4 and 28.0.2.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. Limited direct impact.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-10-30 22:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-11-02 19:35 UTC Last updatedMost recent change to the record

Details

Published

2026-10-30 22:16 UTC

Last modified

2026-11-02 19:35 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-862 · Missing authorization

Record status

Deferred

Attack profile CVSS 3.1 · 6.3

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low