CVE-2026-55147 in Loris
Summary
by MITRE • 10/31/2026
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `API` for the `imaging_browser` module permits edits to imaging data without checking the frontend permissions that restrict editing in Imaging Browser. An authenticated `API` caller can therefore modify imaging data without the required edit authorization. Deployments that no longer use the `API` can disable it to remove access to this endpoint. This issue is fixed in versions 27.0.4 and 28.0.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
LORIS, or Longitudinal Online Research and Imaging System, serves as a critical infrastructure for neuroimaging research by facilitating data management and project coordination through its self-hosted web application architecture. The vulnerability identified in this context affects specific versions of the software, namely those from 22.0.0 up to but not including 27.0.4, and from 28.0.0 up to but not including 28.0.2. This security flaw resides within the API endpoint associated with the imaging_browser module, which is designed to handle interactions related to medical imaging data management. The core technical deficiency lies in a failure of server-side authorization checks during edit operations. While the frontend interface correctly enforces permissions that restrict editing capabilities based on user roles and project assignments, the backend API does not replicate these security controls. Consequently, there exists a discrepancy between client-side enforcement and server-side validation, creating an opportunity for privilege escalation through direct API manipulation rather than standard UI interaction.
The operational impact of this vulnerability is significant because it allows any authenticated user to modify imaging data without possessing the requisite edit authorization. In typical web application security models, frontend permissions are merely convenience features or usability enhancements; they must never be relied upon as the sole mechanism for access control. An attacker who has obtained valid credentials can bypass these restrictions by crafting direct HTTP requests to the affected API endpoints. This capability enables unauthorized modification of sensitive neuroimaging datasets, which compromises data integrity and confidentiality. Since LORIS is often used in academic and clinical research settings involving human subjects, such tampering could lead to invalid scientific results, breach of patient privacy regulations like HIPAA or GDPR depending on jurisdiction, and loss of trust in the platform's ability to safeguard critical health information.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, specifically where a user is able to perform actions that exceed their assigned privileges due to insufficient server-side validation. It also relates closely to CWE-862, Missing Authorization, as the application fails to verify whether the authenticated actor has permission for the specific action being performed on the resource. From an adversarial perspective, this flaw facilitates techniques categorized under MITRE ATT&CK T1078, Valid Accounts, where attackers leverage legitimate credentials to access resources they are not authorized to modify. The lack of consistent authorization checks across different interfaces represents a common architectural weakness in web applications that prioritize rapid development over comprehensive security design principles.
To mitigate this risk, organizations running affected versions must upgrade immediately to version 27.0.4 or later for the older branch, and version 28.0.2 or later for the newer branch, as these releases contain the necessary code corrections to enforce proper authorization checks on the backend API endpoints. For deployments that have migrated away from using the LORIS API entirely, disabling the API service is a viable alternative mitigation strategy to remove access to the vulnerable endpoint and reduce the attack surface. Security teams should also implement strict input validation and ensure that all state-changing operations are protected by robust server-side authorization logic that mirrors or exceeds frontend restrictions. Regular security audits focusing on role-based access control implementation across both UI and API layers are recommended to prevent similar discrepancies in future updates.