What is CVE-2026-55147?

CVE-2026-55147 is a medium-severity vulnerability in Aces Loris, classified under Missing Authorization. CVSS score: 6.3/10. Published 2026-10-30.

How severe is CVE-2026-55147?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Auth bypass in Aces Loris

CVE-2026-55147

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `API` for the `imaging_browser` module permits edits to imaging data without checking the frontend permissions that restrict editing in Imaging Browser. An authenticated `API` caller can therefore modify imaging data without the required edit authorization. Deployments that no longer use the `API` can disable it to remove access to this endpoint. This issue is fixed in versions 27.0.4 and 28.0.2.

Vulnerability class: Broken Access Control

Published 2026-10-30.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Aces Loris — versions >= 22.0.0, < 27.0.4, >= 28.0.0, < 28.0.2

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2026-55147?: CVE-2026-55147 is a medium-severity vulnerability in Aces Loris, classified under Missing Authorization. CVSS score: 6.3/10. Published 2026-10-30.
How severe is CVE-2026-55147?: Medium severity. CVSS v3 base score is 6.3 out of 10.