Unauthorized Access in IRIS Web Application by DFIR

CVE-2026-92605

What is CVE-2026-92605?

The IRIS web application, up to version 2.4.29, has a vulnerability that fails to adequately validate case authorization on comment listing endpoints. This flaw permits attackers who have access to at least one case to sequentially enumerate object identifiers. As a result, they can gain unauthorized access to sensitive comment threads associated with cases they should not be able to see. This can lead to potential exposure of confidential information across various entities such as notes, tasks, IOCs, assets, and evidence items.

References