CVE-2026-55146

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the issuetracker backend does not correctly verify edit access...

CVE-2026-55146

The LORIS (Longitudinal Online Research and Imaging System) web application contains an incorrect access check in its issue_tracker backend. Specifically, in versions 16.0.0 to 27.0.3 and 28.0.0 to 28.0.1 , the backend fails to verify edit permissions even though the frontend restricts them. This...

EUVD-2026-114517

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the issuetracker backend does not correctly verify edit access...

CVE-2026-55146 LORIS has incorrect access checks in issue_tracker

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the issuetracker backend does not correctly verify edit access...

CVE-2026-55146: aces Loris: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and…

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the issuetracker backend does not correctly verify edit access...