CVE-2026-55147 Details

A vulnerability exists in the LORIS web application, specifically in the imaging_browser module's API, allowing authenticated users to edit imaging data without proper authorization. This issue affects LORIS versions 22.0.0 prior to 27.0.4 and 28.0.0 prior to 28.0.2. The vulnerability arises because the API does not enforce the same permission checks that the frontend Imaging Browser requires for editing. As a result, users can modify imaging data through the API without the necessary permissions. Deployments that have disabled the API can remove access to this endpoint.

Users can upgrade to LORIS versions 27.0.4 or 28.0.2, both of which include the necessary permission checks in the API. For projects that no longer use the API, the API can be disabled to remove access to the vulnerable endpoint.