{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "21.0.0"
              },
              {
                "fixed": "27.0.3"
              },
              {
                "introduced": "28.0.0"
              },
              {
                "fixed": "28.0.1"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "1abf7fc3858a96b494bd1ef83698fa1900f64eb8"
            },
            {
              "fixed": "f57f54b42a076bf53ba86e20d4dbf37f63538f58"
            },
            {
              "introduced": "83141ca814d2b8bda0e483589b726ea27f6ed4f7"
            },
            {
              "fixed": "c9bb7c87b405b4e0892cda25ab5fc791bcd562f4"
            }
          ],
          "repo": "https://github.com/aces/loris",
          "type": "GIT"
        }
      ],
      "versions": [
        "28.0.0"
      ]
    }
  ],
  "aliases": [
    "GHSA-qp6x-qfx7-54wp"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35165.json"
  },
  "details": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 21.0.0 to before 27.0.3 and 28.0.1, while the document_repository frontend was restricting file access, the backend endpoint was not correctly verifying access permissions. A user could theoretically download a file that they should not have access to, if they know or can brute force the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.",
  "id": "CVE-2026-35165",
  "modified": "2026-08-12T03:51:24.883404871Z",
  "published": "2026-04-08T18:23:34.101Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35165.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/aces/Loris/security/advisories/GHSA-qp6x-qfx7-54wp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35165"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LORIS has incorrect access checks in document_repository"
}