The vulnerability arises because IRIS Web uses the HTTP GET method to perform actions that alter state on the server. This allows an attacker to construct a forged GET request that, when executed by a victim's authenticated browser, will change system state without the victim's consent. The primary impact is that an attacker can perform unauthorized state-changing operations such as modifying configuration settings or initiating data exports, compromising integrity and potentially leading to further exploitation.

The affected product is the IRIS Web collaboration platform developed by dfir-iris. Versions earlier than 2.4.28 are vulnerable, while version 2.4.28 contains a fix. All deployments running a pre‑2.4.28 release are susceptible.

The CVSS score of 4.3 indicates a medium severity vulnerability. No EPSS data is available, and the issue is not listed in CISA's KEV catalog. The likely attack vector is a web browser; an attacker can lure a logged‑in user to a malicious site that triggers the forged GET request, which the browser will submit automatically. No additional privileges are required beyond the victim’s authenticated session.