CVE-2026-42540

Published: Jun 4, 2026Modified: Jul 22, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests. Version 2.4.28 contains a patch.

Related CWEs

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

References (2)

https://github.com/dfir-iris/iris-web/security/advisories/GHSA-w78h-mx7h-qm3h

Source: security-advisories@github.com

https://github.com/dfir-iris/iris-web/security/advisories/GHSA-w78h-mx7h-qm3h

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.