CVE-2026-39985

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39985", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-08T00:01:47.628Z", "datePublished": "2026-04-09T17:08:49.668Z", "dateUpdated": "2026-04-10T14:07:40.047Z"}, "containers": {"cna": {"title": "LORIS has an open redirect field on login", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/aces/Loris/security/advisories/GHSA-rch2-f5fw-cg95", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/aces/Loris/security/advisories/GHSA-rch2-f5fw-cg95"}, {"name": "https://github.com/aces/Loris/commit/f57f54b42a076bf53ba86e20d4dbf37f63538f58", "tags": ["x_refsource_MISC"], "url": "https://github.com/aces/Loris/commit/f57f54b42a076bf53ba86e20d4dbf37f63538f58"}, {"name": "https://github.com/aces/Loris/releases/tag/v27.0.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/aces/Loris/releases/tag/v27.0.3"}, {"name": "https://github.com/aces/Loris/releases/tag/v28.0.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/aces/Loris/releases/tag/v28.0.1"}], "affected": [{"vendor": "aces", "product": "Loris", "versions": [{"version": "< 27.0.3", "status": "affected"}, {"version": ">= 28.0.0, < 28.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T17:08:49.668Z"}, "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1."}], "source": {"advisory": "GHSA-rch2-f5fw-cg95", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T14:07:32.138509Z", "id": "CVE-2026-39985", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T14:07:40.047Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39985", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T14:07:32.138509Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T14:07:36.189Z"}}], "cna": {"title": "LORIS has an open redirect field on login", "source": {"advisory": "GHSA-rch2-f5fw-cg95", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "aces", "product": "Loris", "versions": [{"status": "affected", "version": "< 27.0.3"}, {"status": "affected", "version": ">= 28.0.0, < 28.0.1"}]}], "references": [{"url": "https://github.com/aces/Loris/security/advisories/GHSA-rch2-f5fw-cg95", "name": "https://github.com/aces/Loris/security/advisories/GHSA-rch2-f5fw-cg95", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/aces/Loris/commit/f57f54b42a076bf53ba86e20d4dbf37f63538f58", "name": "https://github.com/aces/Loris/commit/f57f54b42a076bf53ba86e20d4dbf37f63538f58", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/aces/Loris/releases/tag/v27.0.3", "name": "https://github.com/aces/Loris/releases/tag/v27.0.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/aces/Loris/releases/tag/v28.0.1", "name": "https://github.com/aces/Loris/releases/tag/v28.0.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T17:08:49.668Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39985", "state": "PUBLISHED", "dateUpdated": "2026-04-10T14:07:40.047Z", "dateReserved": "2026-04-08T00:01:47.628Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-09T17:08:49.668Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Loris", "vendor": "aces", "versions": [{"status": "affected", "version": "< 27.0.3"}, {"status": "affected", "version": ">= 28.0.0, < 28.0.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcgill:loris:*:*:*:*:*:*:*:*", "matchCriteriaId": "F04A492D-D20B-4349-B01E-18EC44C8E400", "versionEndExcluding": "27.0.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcgill:loris:28.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "D358B66A-04AC-44F2-8EF6-4332D8AC00F4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1."}, {"lang": "es", "value": "LORIS (Longitudinal Online Research and Imaging System) es una aplicaci\u00f3n web autoalojada que proporciona gesti\u00f3n de datos y proyectos para la investigaci\u00f3n en neuroimagen. Antes de las versiones 27.0.3 y 28.0.1, el par\u00e1metro de redirecci\u00f3n al iniciar sesi\u00f3n en LORIS no estaba validando que el valor de la redirecci\u00f3n estuviera dentro de LORIS, lo que podr\u00eda usarse para enga\u00f1ar a los usuarios para que visitaran URLs arbitrarias si se les proporcionaba un enlace con un par\u00e1metro de redirecci\u00f3n de terceros. Esta vulnerabilidad est\u00e1 corregida en las versiones 27.0.3 y 28.0.1."}], "id": "CVE-2026-39985", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39985", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-10T14:07:32.138509Z", "version": "2.0.3"}}]}, "published": "2026-04-09T18:17:02.653", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/aces/Loris/commit/f57f54b42a076bf53ba86e20d4dbf37f63538f58"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/aces/Loris/releases/tag/v27.0.3"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/aces/Loris/releases/tag/v28.0.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/aces/Loris/security/advisories/GHSA-rch2-f5fw-cg95"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,27.0.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[28.0.0,28.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Loris", "source": "cna", "vendor": "aces"}, "product": "loris", "vendor": "aces"}], "analysis": {"en": {"generated_at": "2026-04-09T18:21:03.808478+00:00", "value": {"mitigation_remediation": ["Upgrade LORIS to version 27.0.3 or later", "Upgrade LORIS to version 28.0.1 or later", "If upgrades are not immediately possible, remove or encode the redirect parameter in login URLs to prevent arbitrary redirection", "Monitor application logs for unexpected redirect attempts and block suspicious traffic"], "summary": {"action": "Update", "impact": "Open Redirect"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the LORIS web application owned by aces. Versions earlier than 27.0.3 and 28.0.1 are impacted; the issue was fixed in those releases.", "description_and_impact": "A flaw in the login process of LORIS allows the redirect parameter to be set to any URL without verification, enabling an attacker to redirect users to malicious sites. This can lead to phishing or credential harvesting but does not directly grant code execution or data exfiltration. The weakness corresponds to an open redirect vulnerability (CWE-601).", "risk_and_exploitability": "The CVSS base score is 4.3, indicating moderate impact. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely web-based, requiring an attacker to supply a crafted login URL with a redirect parameter targeting the victim's browser."}}}}, "created": "2026-04-10T08:52:48.921904+00:00", "updated": "2026-04-10T09:32:00.164511+00:00", "vendors": ["aces", "aces$PRODUCT$loris"]}