Which versions of DFIR-IRIS are affected by CVE-2026-92605?

A broken access-control flaw in DFIR-IRIS (iris-web) up to and including version 2.4.29 allows any authenticated user with access to a single case to read comment threads, notes, task details,…

How to fix or mitigate CVE-2026-92605?

Within 24 hours, treat this as an active access-control gap in any multi-case DFIR-IRIS deployment: inventory all instances on versions up to and including 2.4.29, confirm whether they host more than one case or more than one client, and if so restrict access by limiting the platform to a trusted group and disabling or suspending dormant, contractor, and least-privileged accounts that do not strictly need case access; where a reverse proxy or application gateway sits in front of iris-web, block or rate-limit enumeration patterns against the comment-listing endpoints for notes, tasks, IOCs, assets, and evidence items, and enable verbose audit logging on those endpoints so that sequential-ID scraping is detectable. Within 7 days, contact the DFIR-IRIS maintainers for a fix timeline or interim commit, review audit and web logs for sequential request bursts indicative of prior exploitation, validate that no untrusted account holds blanket case-visibility rights, and segregate high-sensitivity investigations onto a separate, access-restricted instance until a fixed release is available. Within 30 days, upgrade every instance to the first vendor release that addresses CVE-2026-92605 as soon as it ships, re-test object-level authorization across all comment and attachment endpoints after upgrading, and formalize a standing control requiring quarterly external review of cross-tenant authorization in case-management platforms; note that no vendor-released patch is identified at time of analysis, so compensating controls and log-based detection remain the primary defenses until one is published.

DFIR-IRIS CVE-2026-92605

Q: What is the CVSS score of CVE-2026-92605?

CVE-2026-92605 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80898 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-16 VulnCheck

GHSA-2hv7-mq65-pgrr

Iris Web Dfir Iris

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Authenticated low-priv user (PR:L) enumerates IDs over the network (AV:N/AC:L/UI:N) to read unauthorized comment data; confidentiality-only (C:H generous given DFIR-sensitive comments), no integrity/availability impact, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 18:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 16, 2026 - 18:07 vuln.today

CVE Published

Sep 16, 2026 - 17:31 cve.org

HIGH 7.1

DescriptionCVE.org

IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.

AnalysisAI

Broken object-level authorization in DFIR-IRIS (iris-web) through 2.4.29 lets an authenticated user who has legitimate access to just one case read comment threads belonging to cases they are not authorized to see, by enumerating sequential object identifiers against the comment-listing endpoints for notes, tasks, IOCs, assets, and evidence items. The flaw is a classic IDOR (CWE-639) with confidentiality-only impact: the attacker can read but not modify or delete data, and exploitation requires a valid session with PR:L privileges - it cannot be triggered by an unauthenticated outsider. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a valid authenticated session with authorized access to at least one case in DFIR-IRIS (PR:L); the attacker then abuses the comment-listing endpoints for notes, tasks, IOCs, assets, and evidence, which fail to validate case authorization and accept sequential/guessable object identifiers. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a classic IDOR / broken object-level authorization flaw (CWE-639) in DFIR-IRIS, scored 7.1 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version has been identified in the available data, so the primary action is to track the vendor repository (https://github.com/dfir-iris/iris-web) and the VulnCheck advisory (https://www.vulncheck.com/advisories/iris-through-2.4.29-unauthorized-comment-access-via-object-id) and upgrade to the first release published after 2.4.29 that carries the authorization fix. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, treat this as an active access-control gap in any multi-case DFIR-IRIS deployment: inventory all instances on versions up to and including 2.4.29, confirm whether they host more than one case or more than one client, and if so restrict access by limiting the platform to a trusted group and disabling or suspending dormant, contractor, and least-privileged accounts that do not strictly need case access; where a reverse proxy or application gateway sits in front of iris-web, block or rate-limit enumeration patterns against the comment-listing endpoints for notes, tasks, IOCs, assets, and evidence items, and enable verbose audit logging on those endpoints so that sequential-ID scraping is detectable. …

Threat intelligence, references, and detailed analysis are available after sign-in.