CVE-2026-55146

    Dashboard / Vulnerabilities / CVE-2026-55146

    CVE-2026-55146

    Published: 30 Oct 2026Last Modified: 8 Nov 2026

    Summary: LORIS has incorrect access checks in issue_tracker

    Details: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `issue_tracker` backend does not correctly verify edit access permissions, although the frontend restricts which issues a user may edit. An authenticated user can submit backend changes to issues outside the user's permitted edit scope. Deployments that no longer use Issue Tracker can disable the module to remove access to the endpoint. This issue is fixed in versions 27.0.4 and 28.0.2.

    References: https://github.com/aces/Loris/releases/tag/v27.0.4, https://github.com/aces/Loris/releases/tag/v28.0.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55146.json, https://github.com/aces/Loris/security/advisories/GHSA-c9q6-5f24-p7mj, https://nvd.nist.gov/vuln/detail/CVE-2026-55146, https://github.com/aces/Loris/commit/1856d1b4d48d4412d5a5a845024adb70858ec20d, https://github.com/aces/Loris/pull/10531

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 670dcdaf8b2f16daa2fd547ec350d8387059d978
    Fixed -b664f468e1e0633e619f906fb2a5ae72da0c79e0

    Affected versions

    v28.0.1
    v28.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-55146 | CVE-DB