CVE-2026-42547
IRIS Alerts Can be Falsely Attributed to Customers
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
7th
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.
| CWE | CWE-863 |
| Vendor | dfir-iris |
| Product | iris-web |
| Published | Jun 4, 2026 |
| Last Updated | Jun 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for dfir-iris iris-web
Be the first to know when new medium vulnerabilities affecting dfir-iris iris-web are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
dfir-iris / iris-web
< 2.4.28