CVE-2026-35165

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-35165

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35165.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-35165

Aliases

GHSA-qp6x-qfx7-54wp

Published

2026-04-08T18:23:34.101Z

Modified

2026-08-12T03:51:24.883404871Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

LORIS has incorrect access checks in document_repository

Details

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 21.0.0 to before 27.0.3 and 28.0.1, while the document_repository frontend was restricting file access, the backend endpoint was not correctly verifying access permissions. A user could theoretically download a file that they should not have access to, if they know or can brute force the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.

Database specific

{
    "cwe_ids": [
        "CWE-639"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35165.json"
}

References

Affected packages

Git / github.com/aces/loris

Affected ranges

Type

GIT

Repo

https://github.com/aces/loris

Events

Introduced

1abf7fc3858a96b494bd1ef83698fa1900f64eb8

Fixed

f57f54b42a076bf53ba86e20d4dbf37f63538f58

Introduced

83141ca814d2b8bda0e483589b726ea27f6ed4f7

Fixed

c9bb7c87b405b4e0892cda25ab5fc791bcd562f4

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "21.0.0"
        },
        {
            "fixed": "27.0.3"
        },
        {
            "introduced": "28.0.0"
        },
        {
            "fixed": "28.0.1"
        }
    ]
}

Affected versions

28.*

28.0.0

v28.*

v28.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35165.json"