CVE-2026-34985 describes an authorization bypass vulnerability in the aces LORIS application affecting versions >=16.1.0 and <27.0.3, and >=28.0.0 and <28.0.1. The vulnerability arises because the backend media module does not enforce access controls on file requests, relying solely on frontend filtering. This allows an attacker with knowledge of a filename to access files without proper authorization. The issue is addressed in versions 27.0.3 and 28.0.1 where backend access checks are implemented.

An attacker with at least limited privileges (PR:L) can bypass authorization controls to access files they should not be able to view. This can lead to unauthorized disclosure of sensitive neuroimaging research data, impacting confidentiality, integrity, and availability to a limited extent. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.3.

Upgrade affected LORIS instances to version 27.0.3 or later, or 28.0.1 or later, where the backend access control checks have been implemented to fix this vulnerability. Since this is a self-hosted application, administrators must apply these updates manually. Patch status is confirmed by the vendor's versioning information in the advisory.