CVE-2026-42547
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.
Risk Assessment
Risk of falsely attributing alerts to customers and potential exfiltration of other customers' alert data, which could lead to breach of confidentiality and data integrity.
Recommendation
Update IRIS to version 2.4.28 or later and implement proper access controls so that users can only create alerts for assigned customers.
Other vulnerabilities in IRIS
See all- CVE-2026-18362Medium
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.
- CVE-2026-18360High
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
- CVE-2026-16971Medium
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
- CVE-2026-16970Medium
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.
- CVE-2026-16969High
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
- CVE-2026-42543Medium
IRIS platform prior to version 2.4.28 is vulnerable to a CSRF attack because it uses the HTTP GET method to change server state. An attacker can exploit this to perform unauthorized actions on behalf of the victim.
- CVE-2026-42540Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests.
- CVE-2026-42539Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.
- CVE-2026-42538Medium
IRIS is a web collaborative platform that helps incident responders share technical details. Versions prior to 2.4.28 do not properly validate uploaded files, allowing misuse for hosting phishing pages and introducing a Cross-Site Scripting (XSS) vulnerability.
- CVE-2026-42329Medium
Iris platform prior to version 2.4.28 contains a weakness that allows an attacker to redirect the user to a malicious website. This is an open redirect vulnerability.
Original NVD description (English source)
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.