CVE-2026-35400: Email Forgery in LORIS Neuroimaging System

The primary impact of CVE-2026-35400 is the potential for email spoofing. An attacker who has access to the publication module within LORIS can manipulate the baseURL parameter in a POST request to specify an arbitrary external domain. This allows them to craft emails that appear to be sent by LORIS, but are actually originating from the attacker's controlled domain. While the vulnerability is rated LOW severity, successful exploitation could damage the reputation of the research institution using LORIS, lead to phishing attacks targeting researchers, or be used to distribute malicious content under the guise of official LORIS communications. The attacker needs existing publication module access to exploit this, limiting the immediate blast radius.

1. Reserved2026-04-02
2. Published2026-04-08
3. EPSS updated2026-04-16

The primary mitigation for CVE-2026-35400 is to upgrade LORIS to version 27.0.3 or 28.0.1. These versions contain a fix that properly validates the baseURL parameter, preventing the email spoofing vulnerability. If upgrading is not immediately feasible, consider implementing stricter access controls for the publication module to limit the number of users who can potentially exploit the vulnerability. While a direct WAF rule is difficult to implement due to the POST parameter manipulation, monitoring for unusual email sending patterns originating from the LORIS server could provide an early warning sign of potential exploitation. After upgrading, confirm the fix by attempting to submit a publication request with a malicious baseURL and verifying that the request is rejected.