CVE-2026-42543
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IRIS platform prior to version 2.4.28 is vulnerable to a CSRF attack because it uses the HTTP GET method to change server state. An attacker can exploit this to perform unauthorized actions on behalf of the victim.
Risk Assessment
The risk is that an attacker can perform unauthorized operations on the victim's account, such as changing configuration or deleting data, without their knowledge.
Recommendation
Immediately update IRIS to version 2.4.28 or later, which includes a fix for the CSRF vulnerability.
Other vulnerabilities in IRIS
See all- CVE-2026-18362Medium
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.
- CVE-2026-18360High
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
- CVE-2026-16971Medium
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
- CVE-2026-16970Medium
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.
- CVE-2026-16969High
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
- CVE-2026-42547Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.
- CVE-2026-42540Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests.
- CVE-2026-42539Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.
- CVE-2026-42538Medium
IRIS is a web collaborative platform that helps incident responders share technical details. Versions prior to 2.4.28 do not properly validate uploaded files, allowing misuse for hosting phishing pages and introducing a Cross-Site Scripting (XSS) vulnerability.
- CVE-2026-42329Medium
Iris platform prior to version 2.4.28 contains a weakness that allows an attacker to redirect the user to a malicious website. This is an open redirect vulnerability.
Original NVD description (English source)
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 are vulnerable to a cross-site request forgery attack, because they use the HTTP method `GET` to change state on the server. Version 2.4.28 contains a patch.