IRIS is a collaborative platform for incident responders, and in versions before 2.4.28 the application allows a mass assignment vulnerability. By submitting crafted API requests an attacker can change database fields that are normally protected, enabling the alteration of investigation data. This vulnerability falls under CWE‑915 and could compromise the integrity of shared information, potentially allowing a user to inject false evidence or mislead other responders. The impact is limited to data manipulation and does not provide remote code execution or data exfiltration.

All deployments of IRIS Web running a version earlier than 2.4.28 are affected. The vulnerable product is the IRIS Web component of the DFIR‑IRIS suite. Users should check the version reported in the application metadata and upgrade before the patch is applied.

The CVSS score for this issue is 4.3, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to send manipulated API requests, likely while authenticated, to exploit the flaw. The lack of high exploitation probability suggests this vulnerability is less likely to be actively used in the wild but remains an actionable data integrity concern.