LORIS Incorrect Access Control Vulnerability in Media Module

An access control vulnerability has been identified in the LORIS web application, specifically within the media module. This issue affects versions 16.1.0 prior to 27.0.3 and 28.0.1. While the frontend properly filters files based on user access rights, the backend fails to enforce these checks. As a result, individuals who should not have access to certain files can retrieve them if they know the filename.

Impact

Exploitation of this vulnerability allows unauthorized access to files in the media module, bypassing frontend access controls.

Remediation

Users can upgrade to LORIS versions 27.0.3 or 28.0.1 to address this vulnerability.