Description
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.
Published: 2026-09-16
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.
Title IRIS through 2.4.29 Unauthorized Comment Access via Object ID
First Time appeared Dfir-iris
Dfir-iris iris
Weaknesses CWE-639
CPEs cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:*
Vendors & Products Dfir-iris
Dfir-iris iris
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Dfir-iris Iris
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-16T17:31:36.375Z

Reserved: 2026-09-16T13:48:49.971Z

Link: CVE-2026-92605

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-16T18:17:22.243

Modified: 2026-09-16T18:17:22.243

Link: CVE-2026-92605

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key