CVE-2026-92605

EUVD-2026-80898
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/dfir-iris/iris-web
https://github.com/dfir-iris/iris-web/blob/v2.4.29/source/app/blueprints/case/case_notes_routes.py#L404-L411
https://github.com/dfir-iris/iris-web/blob/v2.4.29/source/app/datamgmt/case/case_comments.py#L22
https://github.com/geo-chen/oss/blob/main/iris-web.md
https://www.vulncheck.com/advisories/iris-through-2.4.29-unauthorized-comment-access-via-object-id