CVE-2026-35165

LORIS (Longitudinal Online Research and Imaging System) versions 21.0.0 through 27.0.2 and 28.0.0 contain an access control bypass vulnerability in the document_repository backend endpoint. Despite frontend restrictions, the backend fails to properly verify file access permissions, allowing authenticated users to potentially download files they should not have access to by knowing or brute-forcing filenames. The vulnerability affects self-hosted neuroimaging research data management systems and is remediated in versions 27.0.3 and 28.0.1. The vulnerability carries a MEDIUM CVSS score of 6.5, requiring network access and low attack complexity with user authentication. The primary impact is confidentiality compromise, as attackers with valid credentials can gain unauthorized access to sensitive neuroimaging research data. No integrity or availability impacts are associated with this vulnerability. There is currently no evidence of active exploitation in the wild, with an extremely low EPSS score of 0.00026 indicating minimal practical exploitation likelihood. The vulnerability is not on the CISA Known Exploited Vulnerabilities list and shows no community activity on exploit tracking platforms. Organizations running affected versions should prioritize patching, though the low exploitation risk suggests this is not an imminent threat requiring emergency response.