{"affected":[{"product":"Loris","source":"CNA: GitHub_M","vendor":"aces","versions":[{"status":"affected","version":">= 22.0.0, < 27.0.4"},{"status":"affected","version":">= 28.0.0, < 28.0.2"}]}],"cveId":"CVE-2026-55147","cwes":["CWE-862"],"description":"LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `API` for the `imaging_browser` module permits edits to imaging data without checking the frontend permissions that restrict editing in Imaging Browser. An authenticated `API` caller can therefore modify imaging data without the required edit authorization. Deployments that no longer use the `API` can disable it to remove access to this endpoint. This issue is fixed in versions 27.0.4 and 28.0.2.","epss":{"date":"2026-11-02","percentile":0.11925,"score":0.00215},"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1793630518905,"publishedAt":1793395778725,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/aces/Loris/security/advisories/GHSA-m48r-jv24-jjcx"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aces/Loris/pull/10531"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aces/Loris/commit/b13053597530ee33fbced35085d2490bc9ccc03a"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aces/Loris/releases/tag/v27.0.4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aces/Loris/releases/tag/v28.0.2"}],"remediation":[],"revision":"34c273b509a88c5f705a356e65e1bb3c1470c94121c6adf7fa88f25d4e82c775","sources":[{"modifiedAt":1793630518905,"name":"CNA: GitHub_M","retrievedAt":1793632144849,"url":"https://www.cve.org/CVERecord?id=CVE-2026-55147"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793632151643,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55147"}],"ssvc":{"assessedAt":1793630506832,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"LORIS has incorrect access checks in API for Imaging Browser","updatedAt":1793632151643}