CVE-2026-42547

IRIS Alerts Can be Falsely Attributed to Customers

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.

Analysis

AI-generated

Technical impact

The Iris Web platform allows users to create alerts for customers they are not assigned to. This missing attribute control is a CWE‑863 Missing Authorization flaw that can be abused so that an attacker creates alerts that appear to come from other customers, undermining data integrity. When combined with Cross‑Site Scripting, the attacker can also exfiltrate alerts from other customers, leading to data confidentiality loss.

Affected Systems

Versions of dfir‑iris Iris Web earlier than 2.4.28 are susceptible. The affected product is the Iris Web collaborative platform from the dfir‑iris vendor.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. EPSS is not available and the issue is not listed in the KEV catalog. An attacker needs only an authenticated user account to exploit the flaw via the web interface. The main risk is the ability to falsely attribute alerts and potentially steal alert data through XSS, compromising data integrity and confidentiality.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Iris Web version 2.4.28 or later.
  • Restrict alert creation to assigned customers only in configuration.
  • Implement or strengthen XSS protections on the platform to prevent data exfiltration.

Generated by OpenCVE AI on June 4, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Dfir-iris
Dfir-iris iris
Vendors & Products Dfir-iris
Dfir-iris iris
Type Values Removed Values Added
References
Type Values Removed Values Added
Description IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.
Title IRIS Alerts Can be Falsely Attributed to Customers
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Jun 8, 2026, 3:12 PM
Reserved
Apr 28, 2026, 4:56 PM

View source JSON

Updated
Jun 4, 2026, 9:36 PM

JSON

Status
Deferred
Published
Jun 4, 2026, 10:16 PM
Modified
Jul 22, 2026, 8:10 PM

View source JSON

No data.

Updated
Jun 5, 2026, 7:30 AM

JSON