CVE-2026-92605— IRIS through 2.4.29 Unauthorized Comment Access via Object ID
Quick assessment
Affected
dfir-iris iris-web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads fro
Possible ATT&CK Techniques 1 AI
T1538 · Cloud Service Dashboard
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92605
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IRIS through 2.4.29 Unauthorized Comment Access via Object ID
Source: CVE Program / CVE List V5
Vulnerability Description
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92605
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92605
请登录查看更多情报信息。
Other References for CVE-2026-92605 (4)
-
oss/iris-web.md at main · geo-chen/oss · GitHub third-party-advisory
IV. Related Vulnerabilities
Same product: iris-web
-
CVE-2026-16970
DFIR-IRIS Insufficient Logout Implementation -
CVE-2026-18362
DFIR-IRIS Missing Brute Force Protection in User Authenticat -
CVE-2026-16971
DFIR-IRIS Missing Brute Force Protection in OTP Validation -
CVE-2026-18361
DFIR-IRIS Stored XSS in Datastore Upload -
CVE-2026-18360
DFIR-IRIS Stored XSS in Custom Attributes
Same vendor: dfir-iris
-
CVE-2026-16970
DFIR-IRIS Insufficient Logout Implementation -
CVE-2026-18362
DFIR-IRIS Missing Brute Force Protection in User Authenticat -
CVE-2026-16971
DFIR-IRIS Missing Brute Force Protection in OTP Validation -
CVE-2026-18361
DFIR-IRIS Stored XSS in Datastore Upload -
CVE-2026-18360
DFIR-IRIS Stored XSS in Custom Attributes
Same weakness: CWE-639
-
CVE-2026-47094
SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/ -
CVE-2026-92716
Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege E -
CVE-2026-92603
ContiNew Admin through 4.1.0 Unauthorized Message Deletion v -
CVE-2026-92567
TDuck survey form through 5.0 Unauthorized Data Modification -
CVE-2026-89031
Blog2Social WordPress Plugin < 9.1.0 Broken Access Control v
V. Comments for CVE-2026-92605
No comments yet