CVE-2026-42539 Details
Description
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.
A vulnerability in the IRIS web application, prior to version 2.4.28, allows for excessive data exposure by returning sensitive information to the user that is not necessary for the application's operation. This issue could potentially be exploited to misuse the exposed data, such as password hashes and Multi-Factor Authentication (MFA) secrets, which could amplify the impact of other vulnerabilities like access control issues.
Users are advised to update to IRIS version 2.4.28 or later. It is also recommended to implement an allowlist approach for API responses to prevent the serialization of sensitive data, rather than blocklisting unnecessary fields, which can be error-prone. Using Data Transfer Objects (DTOs) to control serialized attributes can also be an effective strategy.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dfir-iris/iris-web/security/advisories/GHSA-g588-5gmf-p5cx | CISA-ADP | AdvisoryExploitRemedyVendor |
| http://www.openwall.com/lists/oss-security/2026/05/19/9 | CVE | AdvisoryExploitMailing ListRemedy |
| https://github.com/dfir-iris/iris-web/security/advisories/GHSA-g588-5gmf-p5cx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-201 | Insertion of Sensitive Information Into Sent Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DFIR-IRIS | <= 2.4.27 (semver) |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |
| Jun 4, 2026 | CVE Modified | CVE |