The LORIS application improperly trusts the baseURL submitted by a user's POST request in the publication module, rather than using the internal LORIS value. This flaw allows a user with access to the publication module to forge emails to external domains that appear to originate from LORIS. The vulnerability affects versions from 20.0.0 up to but not including 27.0.3, and from 28.0.0 up to but not including 28.0.1. The issue is addressed in versions 27.0.3 and 28.0.1. The CVSS 3.1 base score is 3.5, indicating low severity, with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts limited to integrity only.

The vulnerability allows an attacker with publication module access to send forged emails that appear to come from the LORIS system to external domains. There is no impact on confidentiality or availability. The integrity impact is low, as the attacker can only manipulate the sender address in emails. No known exploits are reported in the wild.

A fix is available in LORIS versions 27.0.3 and 28.0.1. Users should upgrade to these or later versions to remediate the vulnerability. Since this is a self-hosted application, administrators must apply the update manually. Patch status is confirmed by the vendor's versioning information. No additional mitigation steps are specified.