What is CVE-2026-42547?

CVE-2026-42547 is a medium-severity vulnerability in Dfir-iris Iris-web, classified under Incorrect Authorization. CVSS score: 5.4/10. Published 2026-06-04.

How severe is CVE-2026-42547?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Auth bypass in Dfir-iris Iris-web

CVE-2026-42547

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to fals…

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Dfir-iris Iris-web — versions < 2.4.28

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

security-advisories@github.com (x_refsource_CONFIRM)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2026-42547?: CVE-2026-42547 is a medium-severity vulnerability in Dfir-iris Iris-web, classified under Incorrect Authorization. CVSS score: 5.4/10. Published 2026-06-04.
How severe is CVE-2026-42547?: Medium severity. CVSS v3 base score is 5.4 out of 10.