CVE-2026-34985: LORIS Information Disclosure Vulnerability

CVE-2026-34985 Overview

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data and project management for neuroimaging research. A significant authorization bypass vulnerability has been identified in the media module affecting versions from 16.1.0 to before 27.0.3 and 28.0.1. While the frontend of the media module properly filters files that users should not have access to, the backend fails to apply access checks. This allows authenticated users who know a filename to access files they should not be authorized to view, potentially exposing sensitive neuroimaging research data.

Critical Impact

Authenticated attackers can bypass frontend access controls to access restricted files in the media module by directly requesting known filenames, potentially exposing sensitive neuroimaging research data.

Affected Products

• LORIS versions 16.1.0 to before 27.0.3
• LORIS versions 28.0.0 to before 28.0.1
• Self-hosted LORIS neuroimaging research installations

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-34985 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-34985

Vulnerability Analysis

This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), which occurs when the application uses user-supplied input to determine which resources a user can access without properly verifying authorization. In the case of LORIS, the media module implements a split authorization model where the frontend JavaScript properly filters file listings based on user permissions, but the backend API endpoints that serve the actual files fail to perform equivalent access control checks.

The architectural flaw creates a false sense of security—administrators and developers may believe files are protected because the frontend UI hides them from unauthorized users. However, any authenticated user who can determine or guess a valid filename can directly request that file from the backend and receive it, regardless of whether they should have access to it.

Root Cause

The root cause is an inconsistent authorization implementation between the frontend and backend components of the LORIS media module. The frontend application layer correctly implements access control logic to filter which files are displayed to users based on their permissions. However, the backend API endpoints that handle file retrieval requests do not implement corresponding authorization checks. This creates a classic Broken Access Control scenario where security relies solely on client-side enforcement, which can be trivially bypassed.

Attack Vector

The attack vector is network-based and requires low privileges (authentication to the LORIS system). An attacker with valid credentials to a LORIS instance can exploit this vulnerability by:

1. Authenticating to the LORIS application with any valid user account
2. Identifying or guessing filenames of media files they should not have access to (potentially through information disclosure, social engineering, or predictable naming conventions)
3. Directly requesting those files via the backend API, bypassing the frontend access controls
4. Receiving the unauthorized file content since the backend does not validate access permissions

The vulnerability requires no user interaction beyond the initial authentication and does not require any specialized tools—a simple HTTP client or browser developer tools can be used to craft direct requests to the backend endpoints.

Detection Methods for CVE-2026-34985

Indicators of Compromise

• Unusual patterns of file access requests from authenticated users accessing files outside their normal project scope
• Direct API requests to media endpoints that bypass the frontend application
• Access log entries showing users retrieving files from projects they are not assigned to
• Anomalous file download volumes from individual user accounts

Detection Strategies

• Monitor backend API access logs for direct requests to media file endpoints without corresponding frontend navigation events
• Implement server-side logging that correlates user permissions with file access attempts to identify authorization bypass attempts
• Deploy web application firewall (WAF) rules to detect patterns of enumeration or systematic file access requests
• Cross-reference file access logs with user permission databases to identify unauthorized access patterns

Monitoring Recommendations

• Enable detailed access logging for all media module API endpoints
• Implement alerting for users accessing files from projects outside their assigned scope
• Review access logs periodically for patterns of unauthorized file retrieval
• Monitor for unusual API request patterns that may indicate exploitation attempts or file enumeration

How to Mitigate CVE-2026-34985

Immediate Actions Required

• Upgrade LORIS installations to version 27.0.3 or 28.0.1 immediately
• Audit access logs to determine if this vulnerability may have been exploited
• Review file access patterns for any evidence of unauthorized data access
• Consider implementing additional network-level access controls while patching is in progress

Patch Information

The vulnerability is fixed in LORIS versions 27.0.3 and 28.0.1. Organizations running affected versions (16.1.0 through 27.0.2 or 28.0.0) should upgrade to the patched versions as soon as possible. Detailed patch information and upgrade instructions are available in the GitHub Security Advisory.

Workarounds

• Implement network-level access controls to restrict which users can reach the LORIS application server
• Add a reverse proxy or web application firewall in front of LORIS to implement additional authorization checks on media module endpoints
• Restrict user account creation and regularly audit user permissions to minimize the pool of potential attackers
• Consider temporarily disabling the media module if it is not critical to operations until the patch can be applied

# Example: Restrict access to LORIS media module via nginx until patched
# Add to nginx server block configuration
location /media/ {
    # Temporarily restrict access to specific IP ranges
    allow 10.0.0.0/8;
    deny all;
    
    # Forward to LORIS backend
    proxy_pass http://loris_backend;
}