CVE-2026-34985 describes an authorization bypass vulnerability (CWE-639) in the LORIS web application used for neuroimaging research data management. The flaw exists because the backend media module does not enforce access control checks on file requests, relying solely on frontend filtering. This allows an attacker with some level of access (low privileges) to access unauthorized files by guessing or knowing filenames. The vulnerability affects versions >=16.1.0 and <27.0.3, and >=28.0.0 and <28.0.1. It is resolved in versions 27.0.3 and 28.0.1. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level.

An attacker with low privileges can bypass authorization controls to access media files they should not have access to if they know the filenames. This could lead to unauthorized disclosure, modification, or deletion of sensitive neuroimaging research data. The impact is rated medium severity with partial confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

This vulnerability is fixed in LORIS versions 27.0.3 and 28.0.1. Users of affected versions should upgrade to one of these fixed releases to remediate the issue. Since LORIS is self-hosted, patching is the responsibility of the deploying organization. Patch status is confirmed by the vendor advisory stating the fix is included in these versions. No other mitigations or workarounds are indicated.