CVE-2026-92605highCWE-639

CVE-2026-92605: high-severity vulnerability in dfir-iris iris-web

IRIS through 2.4.29 Unauthorized Comment Access via Object ID

Published · Updated

Follow this CVE+ Monitor iris-web

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
dfir-iris · iris-web
Related CVEs — dfir-iris iris-web

In the same product, most dangerous first.

CVE-2024-25624MEDIUMiris-web vulnerable to Server Side Template Injection in reportsEPSS 0.9%CVE-2023-30615MEDIUMImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-webEPSS 0.4%CVE-2026-18362MEDIUMDFIR-IRIS Missing Brute Force Protection in User AuthenticationEPSS 0.4%CVE-2026-22783CRITICALIris Allows Arbitrary File Deletion via Mass Assignment in Datastore File ManagementEPSS 0.4%CVE-2024-25640MEDIUMImproper Neutralization of Alternate XSS Syntax in iris-webEPSS 0.3%CVE-2026-16971MEDIUMDFIR-IRIS Missing Brute Force Protection in OTP ValidationEPSS 0.3%