CVE-2026-35165: LORIS has incorrect access checks in document_repository

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• mcgill loris21.0.0 and later · up to 27.0.2 inclusive
• mcgill loris28.0.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (GitHub_M). Independent of NVD's CPE analysis and usually ahead of it.

• aces Loris

  • >= 21.0.0, < 27.0.3, >= 28.0.0, < 28.0.1affected

Other highest-scoring records for the same primary product.

• CVE-2026-26984LORIS media module vulnerable to remote code execution
  35Monitor
• CVE-2026-35446LORIS has a path traversal in FilesDownloadHandler
  34Monitor
• CVE-2026-34392LORIS has a path traversal in static router
  30Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-33350Apr 8, 2026 · LORIS has a SQL injection in MRI feedback popup
  30Monitor
• ← EarlierCVE-2026-34985Apr 8, 2026 · LORIS has incorrect access checks in media module
  26Monitor
• Later →CVE-2026-35169Apr 8, 2026 · LORIS has potential cross-site scripting in help_editor module
  21Monitor

Root cause

The endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const invoice = await Invoice.findById(req.params.id);2res.json(invoice);

1const invoice = await Invoice.findOne({2  id: req.params.id,3  ownerId: req.user.id,4});5if (!invoice) return res.sendStatus(404);6res.json(invoice);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.