CVE-2026-92605
IRIS through 2.4.29 Unauthorized Comment Access via Object ID
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 16, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 16, 2026
Description
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
iris-webdfir-iris |
|
References
- https://github.com/geo-chen/oss/blob/main/iris-web.mdthird-party-advisory
- https://github.com/dfir-iris/iris-webproduct
- https://github.com/dfir-iris/iris-web/blob/v2.4.29/source/app/blueprints/case/case_notes_routes.py#L404-L411technical-description
- https://github.com/dfir-iris/iris-web/blob/v2.4.29/source/app/datamgmt/case/case_comments.py#L22technical-description
- VulnCheck Advisory: IRIS through 2.4.29 Unauthorized Comment Access via Object IDthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.