CVE-2026-35165 is an authorization bypass vulnerability in the aces LORIS application affecting versions >= 21.0.0 and < 27.0.3, and >= 28.0.0 and < 28.0.1. The backend endpoint responsible for file downloads does not correctly verify access permissions, unlike the frontend which restricts file access. This discrepancy allows users with limited privileges to download files they should not access if they know or can brute force the filenames. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). It is fixed in versions 27.0.3 and 28.0.1.

An attacker with at least limited privileges could bypass intended access controls on file downloads by exploiting the backend endpoint's improper permission checks. This could lead to unauthorized disclosure of sensitive files. The CVSS score of 6.3 reflects a medium severity impact with potential confidentiality, integrity, and availability impacts.

Upgrade affected LORIS instances to version 27.0.3 or later, or 28.0.1 or later, where this authorization bypass vulnerability is fixed. Since this is a self-hosted application, administrators must apply these updates manually. Patch status is confirmed fixed in these versions. No vendor advisory was provided to indicate alternative mitigations or temporary fixes.