CVE-2026-42547

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.

• CWE-863

• https://github.com/dfir-iris/iris-web/security/advisories/GHSA-8hwq-v6vm-9grr
• http://www.openwall.com/lists/oss-security/2026/05/19/12
• https://github.com/dfir-iris/iris-web/security/advisories/GHSA-8hwq-v6vm-9grr

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42541Kubewarden is a policy engine for Kubernetes. Prior to , An …4.3
• CVE-2026-42542TDengine is an open source, time-series database optimized f…7.5
• CVE-2026-42543IRIS is a web collaborative platform that helps incident res…4.3
• CVE-2026-42544Granian is a Rust HTTP server for Python applications. From …7.5
• CVE-2026-42545Granian is a Rust HTTP server for Python applications. From …5.9
• CVE-2026-42546OP-TEE is a Trusted Execution Environment (TEE) designed as …3.8
• CVE-2026-42548Flight is an extensible micro-framework for PHP. Prior to 3.…8.6
• CVE-2026-42549Flight is an extensible micro-framework for PHP. Prior to 3.…4.4
• CVE-2026-4255A DLL search order hijacking vulnerability in Thermalright T…7.8
• CVE-2026-42550Flight is an extensible micro-framework for PHP. Prior to 3.…8.8
• CVE-2026-42551Flight is an extensible micro-framework for PHP. Prior to 3.…7.5
• CVE-2026-42552Flight is an extensible micro-framework for PHP. Prior to 3.…7.5