CVE-2026-92605
MEDIUMCVSS 6.5Description
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.
Timeline
Published:September 16th, 2026 6:17 PM
Last modified:September 24th, 2026 9:08 PM
CVSS Scoring
CVSS v3: 6.5 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/dfir-iris/iris-web
- https://github.com/dfir-iris/iris-web/blob/v2.4.29/source/app/blueprints/case/case_notes_routes.py#L404-L411
- https://github.com/dfir-iris/iris-web/blob/v2.4.29/source/app/datamgmt/case/case_comments.py#L22
- https://github.com/geo-chen/oss/blob/main/iris-web.md
- https://www.vulncheck.com/advisories/iris-through-2.4.29-unauthorized-comment-access-via-object-id
Source: NIST NVD · Data may lag official sources by up to one minute