CVE-2026-42540— IRIS has a Mass Assignment issue
Quick assessment
Affected
dfir-iris iris-web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Iris是DFIR-IRIS开源的一个快速、简单但功能齐全且非常高效的 Go 网络框架。 Iris 2.4.28之前版本存在安全漏洞，该漏洞源于允许用户通过操纵API请求更改数据库中的值。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-42540
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IRIS has a Mass Assignment issue
Source: CVE Program / CVE List V5
Vulnerability Description
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests. Version 2.4.28 contains a patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-915
Source: CVE Program / CVE List V5
Vulnerability Title
Iris 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Iris是DFIR-IRIS开源的一个快速、简单但功能齐全且非常高效的 Go 网络框架。 Iris 2.4.28之前版本存在安全漏洞，该漏洞源于允许用户通过操纵API请求更改数据库中的值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-42540
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42540
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-42540 (1)
Same Patch Batch · dfir-iris · 2026-06-04 · 7 CVEs total
| CVE-2026-42539 | 6.5 MEDIUM | IRIS has an Excessive Data Exposure issue |
| CVE-2026-42538 | 6.3 MEDIUM | IRIS has an Insecure File Upload |
| CVE-2026-42547 | 5.4 MEDIUM | IRIS Alerts Can be Falsely Attributed to Customers |
| CVE-2026-42329 | 4.7 MEDIUM | Iris has an Open Redirect issue |
| CVE-2026-42543 | 4.3 MEDIUM | IRIS has a Cross-Site Request Forgery (CSRF) issue |
| CVE-2026-41522 | Iris has an Improper Authorization issue |
IV. Related Vulnerabilities
Same product: iris-web
-
CVE-2026-92605
IRIS through 2.4.29 Unauthorized Comment Access via Object I -
CVE-2026-16970
DFIR-IRIS Insufficient Logout Implementation -
CVE-2026-18362
DFIR-IRIS Missing Brute Force Protection in User Authenticat -
CVE-2026-16971
DFIR-IRIS Missing Brute Force Protection in OTP Validation -
CVE-2026-18361
DFIR-IRIS Stored XSS in Datastore Upload
Same vendor: dfir-iris
-
CVE-2026-92605
IRIS through 2.4.29 Unauthorized Comment Access via Object I -
CVE-2026-16970
DFIR-IRIS Insufficient Logout Implementation -
CVE-2026-18362
DFIR-IRIS Missing Brute Force Protection in User Authenticat -
CVE-2026-16971
DFIR-IRIS Missing Brute Force Protection in OTP Validation -
CVE-2026-18361
DFIR-IRIS Stored XSS in Datastore Upload
Same weakness: CWE-915
-
CVE-2026-103918
@orpc/zod: Prototype injection in smart coercion -
CVE-2026-103036
@orpc/json-schema: Prototype injection in smart coercion -
CVE-2026-104908
MISP Decaying Model Import Mass Assignment Allows Cross-Orga -
CVE-2026-103235
MISP Event Delegation Mass Assignment Allows Retargeting Del -
CVE-2026-93364
Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via P
V. Comments for CVE-2026-42540
No comments yet