LORIS Document Repository Incorrect Access Check Vulnerability

An access control vulnerability has been identified in the LORIS (Longitudinal Online Research and Imaging System) document repository module, affecting versions 21.0.0 prior to 27.0.3 and 28.0.1. While the frontend was properly restricting file access, the backend endpoint failed to verify permissions correctly. This flaw allowed users to potentially download files they should not have access to, provided they knew or could guess the filename.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files within the document repository module.

Remediation

Users can update to LORIS version 27.0.2 or 28.0.1 to address this vulnerability. Alternatively, LORIS projects that are no longer using the document repository can disable the module to remove access to the vulnerable endpoint.