Vulnerability in Dfir-iris Iris-web
CVE-2026-42540
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests. Version 2.4.28 contains…
Vulnerability class: Mass Assignment
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Dfir-iris Iris-web — versions < 2.4.28
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-42540?
- CVE-2026-42540 is a medium-severity vulnerability in Dfir-iris Iris-web, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 4.3/10. Published 2026-06-04.
- How severe is CVE-2026-42540?
- Medium severity. CVSS v3 base score is 4.3 out of 10.